A security lead must choose how to run two pieces of work. Work item one is a one-off, audit-driven push to close roughly two hundred existing Dependabot alerts across forty repositories by a fixed date, with each alert assigned to an owning engineer. Work item two is an ongoing policy to keep build-time-only, low-impact alerts from cluttering the queue automatically as new ones arrive, without a person looking at each one. The lead wants to map each work item to the GitHub capability designed for it. Which TWO mappings are correct? Select TWO.
- AWork item one is best served by a security campaign, because it bundles a fixed set of existing alerts, assigns owners, and tracks remediation against a deadline. Correct
- BWork item two is best served by a Dependabot auto-triage rule, because it continuously and automatically dismisses newly arriving alerts that match low-impact criteria. Correct
- CWork item one is best served by an auto-triage rule that auto-dismisses the two hundred alerts so the audit shows a clean queue, since both work items are really the same automation.
- DWork item two is best served by a security campaign that is recreated each sprint, because campaigns are the only mechanism that can act on alerts without manual per-alert review.
Why A is correct: A security campaign exists for exactly this time-bound, owner-assigned push against a curated set of existing alerts ahead of an audit.
Why B is correct: Auto-triage rules apply standing criteria to incoming alerts and auto-dismiss matches, which is the ongoing, hands-off filtering the second work item describes.
Why C is wrong: This is tempting because both involve many alerts, but auto-dismissing genuine alerts to fake a clean queue defeats the audit and ignores that a campaign tracks real remediation with owners and a deadline.
Why D is wrong: This misassigns the tools: campaigns coordinate human remediation of a curated set, whereas the ongoing automatic filtering the second item needs is the job of auto-triage rules.