Exam GH-500 Topic 4 Question 112 Discussion
Actual exam question for Microsoft's GH-500 exam
Question #: 112
Topic #: 4
Question #: 112
Topic #: 4
You have a GitHub Enterprise Cloud Organization that contains a private repository named Repo1 and has GitHub Secret Protection enabled. Repo1 contains a workflow that writes an access key ID to config.txt and a secret access key to secrets.txt. Repo1 has secret scanning push protection enabled.
You discover that a developer at your company was able to push changes that contain both the access key ID and the secret access key without the push being blocked.
What is the cause of the issue?
You discover that a developer at your company was able to push changes that contain both the access key ID and the secret access key without the push being blocked.
What is the cause of the issue?
Suggested Answer: D Vote an answer
Secret validation rules: GitHub's secret scanning push protection for AWS credentials checks for a high-confidence pair (the Access Key ID and Secret Access Key) appearing together within the same file or immediate context to prevent false positives.
Separation bypasses detection: Because the developer placed the Access Key ID in config.txt and the Secret Access Key in secrets.txt, the push protection pattern matching did not recognize them as a coupled, valid secret pair, allowing the push to succeed.
Incorrect:
[Not B] The push did NOT include a merge into the default branch:
This is incorrect because push protection scans all pushes to any branch within the repository, not just the default branch, to prevent secrets from entering the commit history anywhere.
[Not C] The push was performed on a private repository:
This is incorrect because GitHub Enterprise Cloud organizations can enable secret scanning and push protection for both public and private repositories alike.
Reference:
https://rogierdijkman.medium.com/privilege-escalation-via-storage-accounts-bca24373cc2e
Separation bypasses detection: Because the developer placed the Access Key ID in config.txt and the Secret Access Key in secrets.txt, the push protection pattern matching did not recognize them as a coupled, valid secret pair, allowing the push to succeed.
Incorrect:
[Not B] The push did NOT include a merge into the default branch:
This is incorrect because push protection scans all pushes to any branch within the repository, not just the default branch, to prevent secrets from entering the commit history anywhere.
[Not C] The push was performed on a private repository:
This is incorrect because GitHub Enterprise Cloud organizations can enable secret scanning and push protection for both public and private repositories alike.
Reference:
https://rogierdijkman.medium.com/privilege-escalation-via-storage-accounts-bca24373cc2e
by Ruby at Jul 10, 2026, 11:41 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).