In GitHub Advanced Security, a security policy helps responders by guiding handling of advisories, alerts, and incident workflows.

• A. It automates remediation tasks.
• B. It eliminates the need for alerts.
• C. It provides guidance on handling advisories, alerts, and incident response workflows.
• D. It only applies to open-source projects.

Answer: (C)

In GitHub Advanced Security, a security policy acts as a playbook for incident response, defining how to handle advisories, alerts, and incident workflows. It lays out who is responsible, the triage steps, escalation paths, timelines, and communication protocols, so responders can act consistently and efficiently during events. The policy guides what actions to take at each stage and how to coordinate remediation efforts, rather than performing remediation itself. It also doesn’t eliminate alerts—alerts still need to be produced and triaged according to the policy. And it isn’t limited to open-source projects; it applies to repositories across different types. So describing it as providing guidance on handling advisories, alerts, and incident response workflows is the accurate, best-fit explanation.