NEW
Font size
WorksheetsModule 3: Secrets Management & Code Scanning
Total questions: 20
Worksheet time: 7mins
Why must secrets such as API keys and tokens never be stored directly in source code?
They increase repository size
They slow down application performance
They grant direct access that attackers can exploit if exposed
They prevent collaboration between developers
Which of the following is a key security risk associated with hardcoded credentials?
Slower CI/CD pipelines
Difficulty rotating compromised credentials
Reduced code readability
Increased merge conflicts
What is a major danger of secrets leaked through commit history?
Loss of code ownership
Attackers can retrieve previously exposed credentials
Repository size increases
Reduced automation efficiency
How does GitHub Secrets protect sensitive values?
By storing them in plain text with access restrictions
By hiding them in comments
By encrypting them and preventing exposure in logs or code
By storing them only in local developer machines
Which capability is provided by GitHub Secrets?
Automatic secret rotation
Centralized encrypted storage for sensitive values
Public sharing of secrets
Manual injection into source files
Where do you navigate to manage GitHub Actions secrets for a repository?
Code > Settings > Security
Settings > Actions > Workflows
Security > Secrets and variables > Actions
Insights > Security
Who can create or update repository secrets?
Any contributor
Only workflow authors
Only users with appropriate permissions
Anyone with read access
Which practice aligns with recommended secret management best practices?
Sharing secrets across all projects
Hardcoding secrets for easier access
Rotating secrets regularly
Storing secrets in documentation
What principle ensures contributors only have the minimum access required to secrets?
Centralized access
Least-privilege permissions
Open collaboration
Default access
Why should secrets be restricted to specific environments?
To simplify repository configuration
To ensure secrets are only used in controlled contexts
To reduce build times
To improve documentation clarity
Why is code scanning essential for secure development?
It replaces testing completely
It detects vulnerabilities and insecure patterns early
It eliminates the need for developers
It guarantees vulnerability-free code
Which is a core capability of GitHub Advanced Security?
Manual vulnerability reporting
Automated code scanning for security vulnerabilities
Performance optimization
UI testing
What advantage do built-in GitHub scanning tools offer compared to open-source scanners?
More customization
Slower setup
Faster setup and tighter integration
No maintenance required
Where can you enable code scanning for a repository?
Actions tab
Pull Requests tab
Security tab
Insights tab
What happens when CodeQL is enabled?
Scans run only manually
Analysis starts automatically on pushes and pull requests
Only quality issues are detected
Results are hidden from developers
Why is automating code scanning important?
It reduces developer accountability
It ensures scans run consistently without manual effort
It slows down development intentionally
It replaces security teams
How are automated scanning results integrated into workflows?
Delivered via external dashboards only
Linked directly to affected code in pull requests
Sent as weekly emails
Stored only in logs
What is a recommended approach to balancing scan results and productivity?
Fix all findings immediately
Ignore low-impact findings permanently
Prioritize high and critical severity issues
Disable scanning frequently
What information is typically included in a code scanning finding?
Developer name only
Severity, affected files, and remediation guidance
Build duration
Commit history
Why integrate code scanning into pull request reviews?
To delay merges
To shift security left and prevent unsafe code from merging
To replace peer review
To reduce CI costs
