GitHub GH-900: Understand Git and GitHub Basics Practice Questions

git commit --amend rewrites the most recent commit, allowing the developer to stage new changes and include them in the existing commit without creating an additional commit. git revert HEAD creates a new commit that undoes the previous commit—it does not modify the original. git reset --hard HEAD~1 removes the last commit entirely and discards all changes, which is destructive and not appropriate here. git cherry-pick HEAD applies the changes from a specific commit onto the current branch; it doesn't amend an existing commit.

A tag is a named reference that points to a specific commit, making it ideal for marking stable release points (e.g., v1.0.0). Unlike branches, tags do not move as new commits are added. A branch is a movable pointer used for ongoing development, not for pinning a specific release snapshot. A fork is a copy of an entire repository on GitHub, not a Git concept for marking points in history. A stash temporarily shelves uncommitted changes and is not used for marking releases.

Dependabot monitors a repository's dependency files and automatically opens pull requests to update dependencies when vulnerabilities are detected, directly addressing the requirement. Secret scanning detects hardcoded secrets and credentials in code—not dependency vulnerabilities. Code scanning uses static analysis (e.g., CodeQL) to find bugs and security vulnerabilities in source code logic, not dependency versions. GitHub Actions is a CI/CD automation platform; while it could be configured to perform dependency checks, it does not natively open PRs for vulnerable dependencies.

Secret scanning automatically detects known secret patterns (such as AWS access keys, API tokens, and private keys) in repository content and alerts repository owners and, in some cases, the service provider. Dependabot alerts detect vulnerable dependencies in package manifests, not hardcoded secrets. Code scanning with CodeQL analyzes source code for logic bugs and security vulnerabilities through static analysis — it does not specifically scan for credential patterns. The GitHub Advisory Database is a curated database of known security vulnerabilities in open-source packages, not a scanning tool.

GitHub Mobile supports reviewing pull requests (viewing diffs, leaving comments, approving or requesting changes) and managing notifications and issues (including applying labels, assigning, and closing issues). These are core triage and review tasks GitHub Mobile is built for. Option A is wrong: while you can view workflow run statuses in GitHub Mobile, you cannot configure or trigger workflows — that requires the web UI or CLI. Option D is wrong: the full web-based editor (github.dev / Codespaces) is a browser feature, not part of the GitHub Mobile app; Mobile has limited inline editing at best. Option B is wrong: configuring branch protection rules is an administrative action only available through the web UI or API, not GitHub Mobile.