GitHub Push Protection Secret Types GH-900
Short answer
DEF GitHub Push Protection detects SSH private keys, OAuth tokens, and API Keys.
Question
Each answer presents a complete solution.
NOTE: Each correct selection is worth one point.
Key Takeaways
Tests knowledge of specific credential types blocked by GitHub's automated security features versus non-secret data.
Learn which three secret types GitHub Push Protection detects: SSH private keys, OAuth tokens, and API Keys. Essential for GH-900 exam prep.
Common mistake: Selecting hardcoded email addresses (A) is incorrect because emails are not treated as high-risk secrets requiring push blocking.
Expert Analysis
GitHub Push Protection is a security feature designed to prevent accidental commits of sensitive credentials. It relies on GitHub's secret-scanning technology, which identifies patterns associated with high-risk secrets.
The correct options are D. SSH private keys, E. OAuth tokens, and F. API Keys. These are explicitly supported secret types that can trigger a push block. SSH private keys are critical for identity verification; OAuth tokens grant access to services; and API Keys are primary authentication mechanisms for various platforms. Blocking these prevents unauthorized access or data breaches.
Hardcoded email addresses (A) are not considered secrets in this context. While they may be PII, they do not provide direct system access like credentials do. Code formatting issues (B) are style concerns handled by linters, not security scanners.
Comments often point to DEF as the solution because these represent the core "secrets" category: cryptographic keys and authentication tokens. The key insight is distinguishing between general data (emails) and actionable credentials (keys/tokens).
Official Reference
https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning
This link opens the official vendor documentation in a new tab.
Exam Strategy
Memorize the categories of secrets GitHub scans for. Focus on 'Keys', 'Tokens', and 'Passwords'. Eliminate options that are clearly not credentials, such as emails, URLs, or code style issues.
Frequently Asked Questions
Does GitHub Push Protection block all types of sensitive data?
What is the difference between secret scanning and Push Protection?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Kiwi28 👍 1The correct answers are D, E, and F. ✅ GitHub Push Protection is designed to detect and block supported secrets before they are pushed. GitHub’s official secret-scanning documentation lists private keys and many provider-specific tokens/keys as supported secret types. GitHub Docs - A. Hardcoded email addresses ❌ — not treated as secrets. - B. Code formatting issue ❌ — unrelated to secret scanning. - C. Database connection strings ❌ — GitHub secret scanning can detect some connection strings, but generic connection-string patterns are not generally covered by default push protection in the way this exam question is targeting. GitHub Docs - D. SSH private keys ✅ - E. OAuth tokens ✅ - F. API Keys ✅
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.