Download GitHub Administration: Security, Permissions, and Best Practices and more Exams Advanced Education in PDF only on Docsity!
GITHUB Admin Test With
Complete Solution
Choose two correct statements concerning the authentication and authorization model that GitHub utilizes with regards to how a user logs in to the system and how those users are granted permissions within the system. - ANSWER Once a user has authenticated into the environment, their designation within an organization will further define what that user will see within GitHub.
Organizations can grant permissions to projects by placing users into teams.
Which of the following are true about the features and capabilities of GitHub Enterprise Cloud? (Select two valid answers.) - ANSWER GHEC provides advanced features such as SAML single sign-on, large file storage, and auditing for compliance.
GHEC is hosted on GitHub's infrastructure, and it ensures that there is robust security and reliability so that organizations do not have to manage their own hardware servers.
As an administrator of GitHub Enterprise, you should determine whether
SAML single sign-on should be enabled for a single organization in your enterprise account, or all of the organizations. What are some of the differences between enabling SAML SSO on an enterprise account for all organizations versus a single organization? - ANSWER Having SSO for all of the organizations in the enterprise makes user management easier but also requires consistent identity policies amongst all organizations.
When it comes to aligning enterprises and organization permissions in the shifting landscape of trust and control, what would be the best practice on GitHub? - ANSWER Use a tiered access model that reflects the sensitivity of the data and the trust level of the users.
What are the consequences and possible abuse vectors for allowing self-hosted runners to be used in public repositories within GitHub Actions? Choose two of the following options. - ANSWER The self-hosted runners running on public repositories expose the host environment of the runner to unauthorized access if they are not configured securely.
Self-hosted runners on a public repository increase the possibility of system resource exhaustion through malicious pull requests.
As the GitHub administrator for "TechPioneers" organization, you have been tasked with reviewing and enhancing the security protocols of the organization's repositories. You must ensure that access to the extremely
Changes in team memberships in AD will appear within GitHub in real time and their response to changes in access will be less latent.
As a repository owner on GitHub, ensuring the security of your software projects is one of the many responsibilities you have. To that end, GitHub has provided a feature that can notify repository administrators and developers about newly discovered vulnerabilities that might affect their repositories. What is the main purpose of GitHub's security vulnerability alerts? - ANSWER To notify the repository administrator and contributors about the vulnerable dependencies found in their projects.
How does GitHub's administrators view license usage statistics for an organization? Choose two of the following which is correct. -ANSWER The license usage statistics can be gained using the API facility of GitHub. The programming world uses this to obtain data regarding seat usage and other information regarding billing.
License Usage Statistics can be directly accessed from the GitHub Organization Dashboard. The dashboard allows accessing the statistics under the 'Billing' section.
What does a user being a member of a GitHub organization imply? - ANSWER It implies that the level of access they have will be defined by the membership role given to them and teams they belong to within that
organization.
Speaking of secure software development enabled and compliance ensured, which two are good enterprise policies you can implement on a GitHub organization? - ANSWER Enforce branch protection rules that include status checks before merge.
Enforce the use of personal access tokens for all Git operations using HTTPS.
As an administrator, you want to ensure that key stakeholders can have easy access to important repositories without sacrificing organizational security in GitHub Enterprise. What is the best method for permission control for such repositories? - ANSWER Use a team-based permissions approach.
Your company wants to use GitHub and enable self-hosted runners for public repositories to make use of specialized processing used in workflows. What are some of the implications and abuse vectors this configuration would have? -ANSWER Malicious users can submit workflows that execute arbitrary code on the self-hosted runner.
What are some of the differences in the implications of enabling SAML Single Sign-On for a single organization versus for all organizations in an enterprise account on GitHub? Choose two correct answers. - ANSWER Reduces
Set up automated alerts to notify administrators of unauthorized access attempts trying to access sensitive data.
Configuration of IP allow lists with regard to the management of GitHub Actions. What would this do to the behavior of GitHub-hosted runners and self-hosted runners? -ANSWER It does restrict access from certain GitHub-hosted services to only the IPs in the list but leaves self-hosted runners unaffected.
What are some of the potential consequences of choosing one set of policies over another to manage a GitHub repository for enabling secure software development and compliance? Select two correct answers. - ANSWER Improved security by requiring 2FA for all contributors.
Slower development velocity due to strict code review requirements.
How might a GitHub administrator manage access and permissions in an organization based on membership? - ANSWER Use teams to place members into roles or projects, then assign team-level permissions that allow access to repositories.
Which of the following are true about OAuth Apps scope and functionality as
related to access to the GitHub API and subscriptions to events? - ANSWER OAuth Apps is a method by which third-party applications can request permissions for access and use OAuth tokens to make authenticated requests to the GitHub API.
Which two things would you consider when designing a strategy to distribute GitHub Actions within an enterprise to ensure proper deployment and governance? -ANSWER Store all of your GitHub Actions in one single, centralized organizational repository for easy access and maintenance.
Implement line-of-business shared Actions versioning and release process to control the manner in which updates are made.
In GitHub, as an organization, how would you do an audit of who has access to a given repository to ensure security policies are in compliance? - ANSWER Use the repository's Audit Log
As a GitHub Admin, you want to share GitHub Actions and workflows across teams at your enterprise in order to increase automation while maintaining compliance. How will you distribute these actions and workflows? - ANSWER Use GitHub Enterprise Server's internal repositories feature to securely manage and distribute customized actions and workflows within the organization.
When establishing organization policies for GitHub to enable secure software
best fit the GitHub usage in his or her company. One needs to make a strategic decision on whether to deploy a single GitHub organization or multiple ones to best support various teams and projects. What should be done to get the most cost-effective benefit for a company with various specific access controls in place that intends to segregate data between different departments? - ANSWER Deploy multiple GitHub organizations, one for each department, to segregate access controls and project data. Within each organization, leverage team-based permissions to control repository access.
What does the automated code analysis tool, CodeQL, from GitHub do inside a repository? - ANSWER CodeQL looks inside the repository for security vulnerabilities and coding mistakes by analyzing the code as databases of facts.
What would be the primary purpose for creating and implementing a response plan for security with regard to sensitive data within a GitHub repository? - ANSWER To provide a framework from which to manage and respond to security breaches of sensitive data, minimizing potential damage.
Which two activities best enable you to support GitHub Enterprise for your end users and key stakeholders by addressing common user concerns and ensuring that the platform is being used optimally? -VIEW Conduct training sessions on using the advanced features of GitHub.
Regularly update security protocols and conduct audits of the same.
Your company is committed to enforcing premium standards with regard to code quality and security for all projects that it hosts on your GitHub. You want to consider tools to implement into the CI/CD pipeline that are predictively able to find vulnerabilities and coding bugs before they get to production. What is the GitHub feature that you should want mainly to enable to scan your code for potential security vulnerabilities and coding errors? -ANSWER Enable GitHub Code Scanning using CodeQL to automatically scan every pull request and push against set rules.
As an administrator of the GitHub repository for "FinTech Innovations," define organization-wide policies that will enhance the security and compliance of your software development. Given the nature of the highly regulated financial technology vertical, which of the following policies would provide the most impact in meeting both security and compliance? -ANSWER Enforce a required code review process on all changes.
Your task is to set up GitHub Apps, which will extend the integration and automation of your development workflow. Setting up these apps involves more than just responding with your repositories and user permissions, but also on specific events coming in through GitHub. If this is correctly configured, it will help you make your organizational policy compliant and improve the security of your development process. If you are setting up a GitHub App for your organization, which of the following correctly describes
Working with GitHub Actions, the administrator has to spot and introduce templates for reuses about actions and workflows. How could he go about it?
- ANSWER The repository 'actions' can be utilized as the place for storing reusable workflows.
Which of the following is correct about GHES in terms of its deployment, distribution, and licensing? ANSWER GHES requires the user to host on-premises on their hardware or on a private cloud. The approach gives the end users extended control over the settings regarding installation and securities.
Which two of the following statements accurately describe the difference between organization member, owner and billing manager permissions on a GitHub organisation? - ANSWER An organization owner can manage team roles and team access to repositories.
An organization owner has access to and can edit all of the admin settings except the billing information.
Which of the following is the correct way to allow specific runners only for particular repositories within an organization when configuring GitHub Actions self-hosted runners? ANS Add the runners to a self-hosted runner group and then grant repository access to that group.
Which of the following best describes and defines the importance of a key security feature in a GitHub repository? - ANSWER Branch protection rules help prevent unauthorized users from committing directly to protected branches, ensuring that changes undergo review before being merged.
What is one result of choosing a suite of policies for a GitHub repository to allow for secure software development and compliance? -ANSWER It impacts speed for the team because it forces certain workflows.
How does its authentication and authorization model work in terms of users' access to resources within the system? - ANSWER The users are being authenticated regarding GitHub credentials, and authorisation on particular resources depends on the role-based access controls set by the organisation.
What would you consider a best practice while managing user identities and authentication for both security and efficiency when setting up GitHub for a large enterprise? ANSWER Apply SSO with an identity provider.
Your company is preparing to migrate to GitHub Enterprise. As an administrator, you've been assigned the task of ensuring users and key stakeholders have necessary permissions and repository access. You are tasked with setting up a complex scenario involving several teams, each with different roles and responsibilities on various projects. Your goal will be to describe how you will set up the permissions model in the repository to
Scenario: A complex corporate scenario wherein a company is using GitHub Enterprise. It contains hundreds of users and wants to have refined access controls for a new project. He needs to make sure that only some selected team members will be able to push to the main branch of a particular repository. What would be the best way, based on this model, to handle user identities and control access in GitHub Authentication and Authorization? - ANSWER Apply branch protection rules in the master branch and grant push permissions only to users or teams.
