NEW
Font size
WorksheetsModule 2: Security with Dependabot
Total questions: 21
Worksheet time: 7mins
Why are dependencies considered a critical security risk in modern applications?
They reduce development speed
They are always maintained by application owners
Attackers often exploit outdated or unpatched dependencies
They eliminate the need for security testing
Which factor increases the risk of dependency-related security issues?
Writing custom libraries
Heavy reliance on external packages
Using private repositories
Frequent code refactoring
What is a vulnerable dependency?
A dependency that is no longer popular
A library with known security flaws that can be exploited
Any dependency older than one year
A dependency without documentation
Why are unpatched dependencies easy targets for attackers?
They require manual installation
They are poorly written
Their vulnerabilities are publicly documented
They are always used in production
What risk is introduced by transitive (nested) dependencies?
Reduced application performance
Inherited vulnerabilities from indirect dependencies
Faster deployment cycles
Improved version control
What is a common consequence of ignoring dependency risks?
Improved development velocity
Reduced audit requirements
Unauthorized access or data leaks
Better system stability
How does dependency mismanagement affect long-term projects?
Simplifies maintenance
Reduces technical debt
Increases maintenance cost and complexity
Eliminates compliance concerns
What is the primary purpose of Dependabot alerts?
Automatically deploy updates to production
Replace manual code reviews
Detect and alert teams about vulnerable dependencies
Manage user access permissions
Where do Dependabot alerts appear in GitHub?
Commit history
Issues tab
Repository security view
Pull request comments only
How does Dependabot prioritize vulnerabilities?
Based on library popularity
By commit frequency
Using severity-based classification
By repository size
When are Dependabot alerts generated?
During scheduled audits
After a release
As soon as new vulnerabilities are disclosed
Only during dependency updates
Why is proper alert configuration important?
To disable minor updates permanently
To reduce GitHub notifications
To ensure alerts are actionable and not overwhelming
To eliminate code reviews
What is a key benefit of automating dependency updates?
Eliminates the need for testing
Reduces exposure to known vulnerabilities
Prevents version changes
Removes developer responsibility
How does Dependabot handle dependency updates?
Directly pushes changes to the main branch
Sends email notifications only
Creates automated pull requests
Updates dependencies during runtime
How should Dependabot pull requests be treated?
Automatically merged without review
Reviewed like any standard code change
Ignored unless critical
Merged only by security teams
What should reviewers focus on when reviewing a Dependabot pull request?
Commit author
Scope, compatibility, and impact of the change
Number of files changed only
Formatting style
What role do automated tests play in dependency updates?
They slow down the merge process
They replace code reviews
They validate that updates do not introduce regressions
They approve updates automatically
When should a dependency update pull request be merged?
Immediately after creation
Only if manual testing is skipped
After all automated checks pass successfully
Only during major releases
What is dependency hygiene primarily focused on?
Reducing repository size
Keeping libraries secure, stable, and maintainable
Limiting open-source usage
Preventing automation
Which practice helps balance security with application stability?
Applying all major upgrades immediately
Ignoring minor vulnerabilities
Testing updates in staging environments
Disabling automated updates
Why integrate Dependabot with CI/CD pipelines?
To deploy dependencies automatically
To ensure dependency updates are validated before deployment
To reduce pull request creation
To replace security teams
