GitHub Administration
Questions & Answers

Option A is correct because organization security settings provide a direct option to require two-factor authentication for all organization members. When enabled, members who don't have 2FA enabled will be removed from the organization and receive a notification. Option B is incorrect because repository rulesets control repository-level policies, not authentication requirements. Option C is incorrect because branch protection rules govern branch-level operations, not user authentication. Option D is incorrect because email reminders are not an enforcement mechanism and don't prevent access without 2FA.

Option B is correct because branch protection rules allow you to enforce requirements such as requiring status checks to pass, requiring a specific number of approving reviews, and preventing direct pushes to protected branches. Option A is incorrect because while Actions workflows can run checks, they don't enforce the review and merge requirements. Option C is incorrect because security advisories are for managing and disclosing security vulnerabilities, not for controlling merge requirements. Option D is incorrect because code scanning alerts identify potential security issues but don't enforce pull request policies.

Option C is correct because secret scanning specifically detects exposed secrets, credentials, and tokens in repositories and can alert administrators or block pushes containing secrets. Option A is incorrect because Dependabot alerts focus on vulnerable dependencies in project manifests, not exposed secrets. Option B is incorrect because CodeQL is designed for identifying code vulnerabilities and security issues in the application logic, not for detecting credential exposure. Option D is incorrect because security policies (SECURITY.md files) provide guidelines for reporting vulnerabilities, not active scanning capabilities.

Option B is correct because the CODEOWNERS file allows you to define individuals or teams responsible for specific files or directories, and GitHub automatically requests reviews from these code owners when relevant files are modified in a pull request. Option A is incorrect because while Actions can automate tasks, using CODEOWNERS is the native and more appropriate solution for automatic reviewer assignment. Option C is incorrect because webhooks send notifications about events but don't automatically assign reviewers. Option D is incorrect because branch protection rules can require code owner reviews but don't handle the automatic assignment based on file paths.

Option B is correct because creating a team with read permissions and adding contractors as organization members provides centralized management, allows for easy permission adjustments, and maintains proper access control. Option A is less efficient for managing multiple repositories and multiple users. Option C is incorrect and insecure because sharing credentials violates security best practices and doesn't provide individual accountability. Option D is incorrect because outside collaborators cannot be added to teams; they must be organization members to be part of a team.