I85PREP
⌘ K
GitHub Advanced Security study materials
GitHub Advanced Security study resources

GitHub Advanced Security practice questions

One question at a time. Build your GitHub Advanced Security understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1GitHub Advanced Security (skills measured per exam study guide)

Which GitHub Advanced Security feature scans a repository's dependency graph and raises Dependabot alerts when a package version matches a known advisory?

  1. Dependabot alerts Correct answer.
  2. Code scanning with CodeQL
  3. Security advisories drafting
  4. Secret scanning push protection

Explanation

Dependabot alerts compare the dependency graph against the GitHub Advisory Database and notify maintainers when a vulnerable version is in use. CodeQL analyzes first-party source code, secret scanning looks for credentials, and advisory drafting is a disclosure workflow rather than dependency alerting.

Question 2GitHub Advanced Security (skills measured per exam study guide)

A security team wants pull requests to fail automatically when CodeQL finds a high-severity issue. Which configuration element enforces that outcome?

  1. A branch protection rule requiring the code scanning check to pass Correct answer.
  2. A saved code scanning filter in the Security tab
  3. An organization README badge for code scanning
  4. A repository topic named codeql-enforced

Explanation

Code scanning results become status checks on the head commit, so requiring that check in branch protection blocks merges when the analysis reports findings at the configured severity threshold. Topics, README badges, and saved filters affect visibility only and cannot gate merges.

Question 3GitHub Advanced Security (skills measured per exam study guide)

What does secret scanning push protection do when a contributor attempts to push a commit containing a recognized credential?

  1. It rejects the push and offers a bypass with a documented reason and permission Correct answer.
  2. It silently allows the push and creates an alert afterward
  3. It encrypts the secret in the repository and continues the push
  4. It rewrites the commit to redact the secret and allows the push

Explanation

Push protection blocks the push before the secret reaches the repository and lets authorized users bypass only by recording a reason such as a false positive or test credential. The commit is not rewritten or encrypted, and the block happens before any alert is generated.

Question 4GitHub Advanced Security (skills measured per exam study guide)

Which statement describes how CodeQL analyzes code?

  1. It compares file hashes against a list of known vulnerable snippets
  2. It runs pattern-matching regular expressions over the raw text of each file
  3. It executes the application in a sandbox and observes runtime behavior
  4. It compiles source into a relational database and runs declarative queries against it Correct answer.

Explanation

CodeQL extracts a codebase into a queryable database and evaluates queries that model data flow and control flow, which enables finding issues across files. Regex matching, runtime sandboxing, and hash comparison do not provide that semantic data-flow analysis.

Question 5GitHub Advanced Security (skills measured per exam study guide)

An organization enables GitHub Advanced Security on a private repository. Which capability becomes available that is not present on a public repository without a license?

  1. Issue tracking and pull request reviews
  2. GitHub Actions minutes for CI builds
  3. Code scanning and secret scanning alerts on private code Correct answer.
  4. Repository wikis and project boards

Explanation

GHAS licenses bring code scanning, secret scanning, and dependency review to private repositories, whereas public repositories get several of these features without a license. Issues, Actions minutes, wikis, and project boards are general platform features unrelated to GHAS entitlement.

Question 6GitHub Advanced Security (skills measured per exam study guide)

A repository uses a matrix build across three operating systems, and each job runs the CodeQL action. Why is specifying a distinct category value per matrix leg important?

  1. It keeps results from each leg separate so analyses do not overwrite each other Correct answer.
  2. It encrypts the uploaded SARIF results at rest
  3. It automatically fixes findings the queries report
  4. It reduces the number of Actions minutes consumed by the workflow

Explanation

The analysis category distinguishes SARIF uploads so results from different matrix legs are stored and displayed independently rather than replacing one another. Category has no effect on billing, encryption, or remediation.

Question 7GitHub Advanced Security (skills measured per exam study guide)

Which file format does code scanning use to ingest results produced by third-party analysis tools?

  1. CycloneDX JSON
  2. JUnit XML
  3. Cobertura XML
  4. SARIF Correct answer.

Explanation

Static Analysis Results Interchange Format (SARIF) is the format code scanning accepts for uploads from any compatible analyzer. JUnit and Cobertura report test and coverage results, and CycloneDX describes software bills of materials.

Question 8GitHub Advanced Security (skills measured per exam study guide)

What is the primary function of the dependency graph in a GitHub repository?

  1. It lists contributors who have commit access to the default branch
  2. It stores the compiled binaries produced by CI workflows
  3. It records direct and transitive dependencies parsed from manifest and lock files Correct answer.
  4. It maps source files to the CodeQL queries that analyze them

Explanation

The dependency graph is built from manifest and lock files and captures direct and transitive packages, which underpins Dependabot alerts and dependency review. It does not store build artifacts, list contributors, or associate files with queries.

Question 9GitHub Advanced Security (skills measured per exam study guide)

A maintainer wants a pull request to be blocked when it introduces a dependency with a known vulnerability. Which GitHub feature should be configured as a required status check?

  1. Dependency review action Correct answer.
  2. CodeQL autobuild
  3. Secret scanning
  4. Dependabot version updates

Explanation

The dependency review action compares the dependency changes in a pull request against the advisory database and fails the check when vulnerable packages are added. Version updates open upgrade pull requests, secret scanning looks for credentials, and autobuild prepares CodeQL databases.

Question 10GitHub Advanced Security (skills measured per exam study guide)

Which secret scanning capability helps a partner service invalidate a leaked credential after GitHub detects it?

  1. Secret scanning partner program Correct answer.
  2. CodeQL community query packs
  3. Dependabot security updates
  4. Organization audit log streaming

Explanation

Through the secret scanning partner program, token issuers are notified when their credentials are found in public repositories and can revoke them automatically. Query packs, Dependabot updates, and audit log streaming do not perform credential revocation.

Question 11GitHub Advanced Security (skills measured per exam study guide)

A team wants CodeQL to run only on pull requests that target the default branch, not on every push. Which workflow trigger configuration achieves this?

  1. push with a paths-ignore filter
  2. schedule with a cron expression
  3. workflow_dispatch with required inputs
  4. pull_request with a branches filter for the default branch Correct answer.

Explanation

Triggering on pull_request and filtering branches to the default branch limits analysis to pull requests targeting that branch. A push trigger analyzes commits rather than pull requests, a schedule runs periodically, and workflow_dispatch requires manual invocation.

Question 12GitHub Advanced Security (skills measured per exam study guide)

Which query suite should a team choose to get a broader set of CodeQL security checks that may include lower-confidence results?

  1. security-extended Correct answer.
  2. code-scanning-minimal
  3. default
  4. security-and-quality

Explanation

The security-extended suite adds lower-severity and lower-precision security queries beyond the default set. The security-and-quality suite adds maintainability queries, and code-scanning-minimal is not a standard suite name.

Question 13GitHub Advanced Security (skills measured per exam study guide)

What is the purpose of a CodeQL query pack?

  1. It packages the compiled application for deployment
  2. It defines the runner image used by the workflow
  3. It bundles queries and their dependencies for distribution and reuse Correct answer.
  4. It stores SARIF results from previous analyses

Explanation

A query pack is a distributable collection of queries with metadata and dependencies, allowing teams to share custom or community analyses. It is not an application package, a results store, or a runner image definition.

Question 14GitHub Advanced Security (skills measured per exam study guide)

A security manager needs a single organization-level view of open code scanning, secret scanning, and Dependabot alerts across many repositories. Which location provides this?

  1. The Actions usage billing page
  2. The Security overview page for the organization Correct answer.
  3. Each repository's Insights tab
  4. The organization's People page

Explanation

Security overview aggregates alert data across repositories in an organization with filters by tool, severity, and repository. Insights covers traffic and dependency metrics, People lists membership, and billing shows consumption.

Question 15GitHub Advanced Security (skills measured per exam study guide)

How does the CodeQL CLI differ from the code scanning workflow in GitHub Actions?

  1. The CLI runs analysis locally or in another CI system and can upload SARIF to GitHub Correct answer.
  2. The CLI replaces the need for a database extraction step
  3. The CLI performs secret scanning instead of code analysis
  4. The CLI only works on public repositories and cannot upload results

Explanation

The CodeQL CLI gives teams the ability to create databases, run queries, and upload SARIF from a local machine or third-party CI. It still requires database extraction and does not perform secret scanning.

Question 16GitHub Advanced Security (skills measured per exam study guide)

Which configuration allows a repository administrator to dismiss a Dependabot alert as tolerable risk?

  1. Deleting the dependency graph
  2. Dismissing the alert with a reason such as 'no bandwidth' or 'tolerable risk' Correct answer.
  3. Removing the repository topic
  4. Disabling the default branch

Explanation

Maintainers can dismiss Dependabot alerts with a documented reason, and the dismissal is recorded in the alert timeline. Deleting the graph or changing branch or topic settings does not represent a reasoned risk decision and disrupts other features.

Question 17GitHub Advanced Security (skills measured per exam study guide)

A team wants Dependabot to open pull requests that upgrade vulnerable dependencies to patched versions without manual scheduling. Which feature should be enabled?

  1. CodeQL autobuild
  2. Secret scanning push protection
  3. Dependabot version updates
  4. Dependabot security updates Correct answer.

Explanation

Dependabot security updates react to alerts by raising pull requests that move a vulnerable dependency to a fixed version. Version updates follow a configured schedule for routine upgrades, while autobuild and push protection address unrelated concerns.

Question 18GitHub Advanced Security (skills measured per exam study guide)

Which statement about custom secret scanning patterns is accurate?

  1. They replace the need for push protection
  2. They only apply to public repositories
  3. They let an organization detect proprietary token formats not covered by default patterns Correct answer.
  4. They are defined in the repository's CODEOWNERS file

Explanation

Custom patterns extend secret scanning to organization-specific credential formats such as internal API keys. They complement rather than replace push protection, are configured in security settings rather than CODEOWNERS, and are available for private repositories under GHAS.

Question 19GitHub Advanced Security (skills measured per exam study guide)

What does the 'dry run' option for a custom secret scanning pattern provide?

  1. It converts the pattern into a CodeQL query
  2. It automatically revokes any matched credentials
  3. It reports matches without generating alerts so the pattern can be tuned Correct answer.
  4. It publishes the pattern to the public advisory database

Explanation

A dry run surfaces potential matches for review before the pattern is published, reducing false positives. It does not revoke credentials, publish advisories, or generate CodeQL queries.

Question 20GitHub Advanced Security (skills measured per exam study guide)

Which action should be taken first when a secret scanning alert reports a valid credential committed to a repository?

  1. Add the secret to a custom pattern
  2. Delete the repository's dependency graph
  3. Revoke and rotate the credential at the issuing service Correct answer.
  4. Close the alert as a false positive

Explanation

Because the credential is already in Git history, the priority is to revoke and rotate it at the issuer so the leaked value becomes useless. Dismissing the alert or altering unrelated configuration leaves the exposure intact.

Question 21GitHub Advanced Security (skills measured per exam study guide)

What distinguishes a repository security advisory from a Dependabot alert?

  1. The advisory only applies to private repositories
  2. The advisory is a project-authored disclosure for a vulnerability in the project itself Correct answer.
  3. The advisory is a SARIF file uploaded by CodeQL
  4. The advisory is generated automatically from the dependency graph

Explanation

Repository security advisories are written by maintainers to coordinate disclosure of vulnerabilities in their own project and can be used to request a CVE. Dependabot alerts are generated from dependency data, and SARIF uploads belong to code scanning.

Question 22GitHub Advanced Security (skills measured per exam study guide)

Which permission is required for a workflow to upload code scanning results to a repository?

  1. security-events: write Correct answer.
  2. contents: read
  3. packages: read
  4. issues: write

Explanation

Uploading SARIF requires the security-events write permission so the workflow can create code scanning analyses. Repository content read, issue write, and package read permissions do not authorize security event uploads.

Question 23GitHub Advanced Security (skills measured per exam study guide)

A team maintains a compiled language project and the CodeQL autobuild step fails because the build system is unsupported. What is the recommended remedy?

  1. Disable the dependency graph
  2. Add a category value to the analyze step
  3. Switch the query suite to security-extended
  4. Replace autobuild with explicit manual build commands in the workflow Correct answer.

Explanation

When autobuild cannot detect a supported build method, the workflow should run the project's own build commands manually so the extractor can observe compilation. Query suites, dependency graph settings, and category labels do not affect whether the build succeeds.

Question 24GitHub Advanced Security (skills measured per exam study guide)

How are code scanning alerts on a pull request typically surfaced to reviewers?

  1. As new issues assigned to the author
  2. As Dependabot pull requests
  3. As entries in the repository's wiki
  4. As annotations on the changed lines and as a check run summary Correct answer.

Explanation

Code scanning presents pull request findings inline on affected lines and summarizes them in the check run, which helps reviewers see problems in context. It does not create assigned issues, Dependabot pull requests, or wiki entries.

Question 25GitHub Advanced Security (skills measured per exam study guide)

An organization wants to prevent secrets from being committed across all repositories without configuring each one individually. Which approach is appropriate?

  1. Set the default workflow permission to read-only
  2. Require signed commits on each default branch
  3. Enable push protection for secret scanning at the organization level Correct answer.
  4. Add a CODEOWNERS file to every repository

Explanation

Organization-level settings can enable secret scanning push protection across repositories so new commits are screened consistently. CODEOWNERS, signed commits, and read-only workflow permissions improve governance but do not detect credentials.

Question 26GitHub Advanced Security (skills measured per exam study guide)

Which GitHub Advanced Security feature scans repository history and open pull requests for credentials such as API keys and tokens using patterns maintained by GitHub?

  1. Secret scanning Correct answer.
  2. Code scanning with CodeQL
  3. Dependency review
  4. Security advisories

Explanation

Secret scanning detects credentials in repository content and history using GitHub-maintained detectors for partner and generic patterns. Dependency review and CodeQL target dependencies and code flaws rather than credential strings. Security advisories are a disclosure mechanism, not a detection engine.

Question 27GitHub Advanced Security (skills measured per exam study guide)

What does the dependency graph record for a repository?

  1. The manifests and lockfiles detected and the packages they declare Correct answer.
  2. The list of contributors with write access
  3. The commit history of the default branch
  4. The results of CodeQL analysis runs

Explanation

The dependency graph is built from manifest and lockfile contents and records the packages and versions a repository depends on. It underpins Dependabot alerts and dependency review. It does not track commit history, permissions, or code scanning results.

Question 28GitHub Advanced Security (skills measured per exam study guide)

Which GitHub Advanced Security capability alerts a repository when a dependency it uses has a published vulnerability listed in the GitHub Advisory Database?

  1. Repository rulesets
  2. CodeQL query suites
  3. Secret scanning push protection
  4. Dependabot alerts Correct answer.

Explanation

Dependabot alerts are generated when the dependency graph matches a package version to an advisory in the GitHub Advisory Database. CodeQL finds flaws in first-party code, secret scanning finds credentials, and rulesets enforce branch policies.

Question 29GitHub Advanced Security (skills measured per exam study guide)

What is the role of a CodeQL database in the analysis process?

  1. It holds the encrypted secrets detected during a scan
  2. It caches dependency downloads for faster builds
  3. It stores the alert history for a repository's code scanning results
  4. It is a relational representation of a codebase created by the extractor that queries run against Correct answer.

Explanation

The CodeQL extractor converts source code and build information into a queryable database, and CodeQL queries evaluate that database to produce results. Alerts, dependency caches, and secret findings are stored elsewhere. Without a successfully created database, no analysis can occur.

Question 30GitHub Advanced Security (skills measured per exam study guide)

A developer pushes a commit containing a GitHub personal access token and the push is rejected with a message about secret scanning. Which feature caused the rejection?

  1. Dependabot security updates
  2. Dependency review action
  3. Code scanning default setup
  4. Secret scanning push protection Correct answer.

Explanation

Push protection evaluates pushed content against secret scanning detectors and blocks the push before the secret reaches the remote. Dependabot and dependency review concern packages, and code scanning analyzes code for vulnerabilities rather than credential strings.

Question 31GitHub Advanced Security (skills measured per exam study guide)

Which alert state indicates that a code scanning finding was reviewed and judged not to require remediation?

  1. Open
  2. Fixed
  3. Dismissed Correct answer.
  4. Reopened

Explanation

Dismissing an alert records a reviewer decision that the finding is acceptable, optionally with a reason and comment. Open means it still requires attention, fixed means the analysis no longer reports it, and reopened means a previously dismissed or fixed alert reappeared.

Question 32GitHub Advanced Security (skills measured per exam study guide)

What does a security configuration in GitHub Advanced Security allow an organization to do?

  1. Run CodeQL only on the default branch of one repository
  2. Enable and tune GHAS features across many repositories from one definition Correct answer.
  3. Encrypt repository contents at rest
  4. Replace branch protection rules with code owners

Explanation

Security configurations are reusable settings that let organizations enable features such as code scanning, secret scanning, and Dependabot and apply them to groups of repositories at scale. They do not handle encryption, code ownership, or single-repository scoping. This reduces per-repository configuration drift.

Question 33GitHub Advanced Security (skills measured per exam study guide)

Which file in a repository supplies custom CodeQL query selection and paths for advanced code scanning setup?

  1. SECURITY.md
  2. codeql-config.yml referenced by the workflow Correct answer.
  3. .github/dependabot.yml
  4. CODEOWNERS

Explanation

Advanced setup can reference a CodeQL configuration file that specifies query packs, query filters, and paths to include or exclude. Dependabot configuration governs update behavior, SECURITY.md gives disclosure guidance, and CODEOWNERS assigns reviewers. Only the CodeQL config file influences analysis scope and queries.

Question 34GitHub Advanced Security (skills measured per exam study guide)

A repository enables Dependabot alerts but the security team also wants automatic pull requests that bump vulnerable dependencies to patched versions. Which setting should be enabled?

  1. Secret scanning push protection
  2. Dependabot version updates
  3. Dependabot security updates Correct answer.
  4. Code scanning default setup

Explanation

Dependabot security updates act on vulnerability alerts by opening pull requests that upgrade the affected dependency to a non-vulnerable version. Version updates follow a schedule for routine upgrades regardless of advisories. Push protection and code scanning address secrets and code flaws, not dependency remediation.

Question 35GitHub Advanced Security (skills measured per exam study guide)

A workflow needs to upload SARIF results produced by a third-party linter to code scanning. Which permission must the workflow's GITHUB_TOKEN have?

  1. pull-requests: write
  2. contents: write
  3. security-events: write Correct answer.
  4. actions: read

Explanation

Uploading SARIF to code scanning requires the security-events write permission so the token can create analysis results and alerts. Contents write is for modifying repository files, pull-requests write is for commenting on or changing pull requests, and actions read is for reading workflow data.

Question 36GitHub Advanced Security (skills measured per exam study guide)

A security team wants dependency review to fail a pull request that introduces a dependency with a high-severity vulnerability. Which approach implements this?

  1. Adding the path to CODEOWNERS for mandatory review
  2. Adding a dependency review action step with a fail-on-severity threshold and requiring the check Correct answer.
  3. Enabling Dependabot version updates on a daily schedule
  4. Turning on secret scanning push protection

Explanation

The dependency review action evaluates dependency changes in a pull request and can be configured to fail when a newly introduced dependency meets a severity threshold. Making that check required in branch protection then blocks merging. Version updates, code owners, and push protection do not evaluate new dependencies against advisories.

Question 37GitHub Advanced Security (skills measured per exam study guide)

An organization wants to block pushes containing detected secrets across all repositories at once, including repositories created later. Which configuration achieves this?

  1. Enabling push protection in an organization-level security configuration applied to all repositories Correct answer.
  2. Requiring signed commits in branch protection
  3. Adding a pre-commit hook to each developer workstation
  4. Creating a custom pattern in every repository individually

Explanation

Security configurations apply feature settings such as push protection at the organization level and can cover all current and future repositories, avoiding per-repository toggles. Workstation hooks are unenforceable and easy to bypass, per-repository patterns do not scale, and signed commits verify authorship rather than content.

Question 38GitHub Advanced Security (skills measured per exam study guide)

A team enables code scanning with a workflow that runs CodeQL on pull requests. Reviewers need to see new findings before approving. How are those findings typically presented?

  1. As inline annotations in the pull request diff and as a check run summary Correct answer.
  2. Only in an emailed daily digest
  3. As a comment added by Dependabot
  4. Only after the pull request is merged

Explanation

Code scanning results from a pull request analysis appear as annotations on the affected lines in the diff and are summarized in the check run, so reviewers see them during review. They are not limited to email or post-merge reporting, and Dependabot comments concern dependency updates.

Question 39GitHub Advanced Security (skills measured per exam study guide)

A repository uses CodeQL advanced setup and analysis is slow because vendored third-party code is included. Which configuration change reduces analysis scope?

  1. Increasing the runner size for the workflow
  2. Adding exclude paths for the vendored directory in the CodeQL configuration file Correct answer.
  3. Switching the query suite to a broader one
  4. Disabling the dependency graph

Explanation

Excluding vendored paths from the CodeQL configuration prevents the extractor and queries from processing that code, reducing database size and runtime. A broader query suite increases work, larger runners add capacity without reducing scope, and the dependency graph is unrelated to CodeQL extraction.

Question 40GitHub Advanced Security (skills measured per exam study guide)

A leaked credential is reported as a valid secret scanning alert. What should the team do immediately after confirming validity?

  1. Rotate or revoke the credential and then address the exposure in history Correct answer.
  2. Wait for GitHub to revoke the credential automatically
  3. Delete the repository to remove the alert
  4. Dismiss the alert as a false positive

Explanation

Once a live credential is confirmed, the priority is to revoke or rotate it so it cannot be abused, then remove or remediate the exposure and review usage logs. Dismissing it leaves the credential active, GitHub cannot revoke arbitrary credentials on the team's behalf, and deleting a repository is destructive and unnecessary.

Question 41GitHub Advanced Security (skills measured per exam study guide)

A custom secret scanning pattern is being prepared. What does the dry run option provide before the pattern is published?

  1. It converts the pattern into a CodeQL query
  2. It reports matches found in the organization's repositories without creating alerts Correct answer.
  3. It disables push protection for the organization
  4. It permanently deletes matching secrets from history

Explanation

A dry run scans existing content with the proposed pattern and reports potential matches so the team can gauge noise and refine the expression before enabling it. It does not alter repository history, change push protection settings, or generate CodeQL queries. Publishing without this check risks alert floods.

Question 42GitHub Advanced Security (skills measured per exam study guide)

An organization wants a single place to see which repositories have code scanning, secret scanning, and Dependabot enabled and which alerts are open. Which capability provides this?

  1. The organization audit log
  2. The Actions usage report
  3. The organization security overview Correct answer.
  4. A repository's commit graph

Explanation

The security overview aggregates alert counts and feature enablement across repositories in an organization, supporting rollout tracking and prioritization. The commit graph shows history, the usage report covers Actions minutes, and the audit log records administrative events rather than alert posture.

Question 43GitHub Advanced Security (skills measured per exam study guide)

A repository wants to allow a specific low-risk secret scanning alert to be ignored without disabling detection for that pattern. Which mechanism fits?

  1. Adding a pattern to the repository's secret scanning ignore configuration Correct answer.
  2. Removing the affected file from the default branch
  3. Deleting the detector from the organization
  4. Turning off secret scanning entirely

Explanation

Secret scanning supports ignoring specific patterns or paths through configuration so known non-sensitive matches stop generating alerts while detection stays active. Disabling the detector or the feature removes protection broadly, and deleting files is destructive and may not remove history.

Question 44GitHub Advanced Security (skills measured per exam study guide)

A team wants Dependabot to propose upgrades for outdated dependencies on a weekly cadence even when no advisory exists. Which configuration accomplishes this?

  1. Dependabot security updates enabled alone
  2. A CodeQL query pack for dependencies
  3. A dependency review action with a severity threshold
  4. A dependabot.yml entry with the package ecosystem, directory, and a weekly schedule Correct answer.

Explanation

Version updates are driven by a dependabot.yml configuration that names the ecosystem, manifest directory, and update interval. Security updates respond only to advisories, dependency review gates pull requests, and CodeQL analyzes code rather than proposing upgrades.

Question 45GitHub Advanced Security (skills measured per exam study guide)

A repository owner wants to publish a vulnerability in their own project with a CVE identifier and credit researchers. Which GitHub feature supports this workflow?

  1. A Dependabot alert
  2. A code scanning alert
  3. A secret scanning alert
  4. A repository security advisory Correct answer.

Explanation

Repository security advisories let maintainers privately collaborate on a vulnerability, request a CVE, and publish the advisory with credits and affected versions. Dependabot, code scanning, and secret scanning alerts are detections generated by tooling, not disclosure documents authored by maintainers.

Question 46GitHub Advanced Security (skills measured per exam study guide)

A CodeQL analysis of a pull request reports a new SQL injection finding, but the same code was previously analyzed on the default branch without an alert. Which explanation is most likely?

  1. The alert was automatically dismissed by GitHub
  2. The pull request analysis used a different query set or the code path is newly reachable in the change Correct answer.
  3. Secret scanning suppressed the result
  4. CodeQL cannot analyze pull requests

Explanation

Differences in query selection, configuration, or newly introduced data flow can cause a finding to appear only in the pull request analysis. CodeQL does analyze pull requests, alerts are not auto-dismissed in this way, and secret scanning does not suppress code scanning results. Reviewing the analysis configuration and the diff clarifies the cause.

Question 47GitHub Advanced Security (skills measured per exam study guide)

An organization enables default setup for code scanning on many repositories, but one repository's language is not supported by CodeQL. What is the appropriate outcome?

  1. CodeQL analyzes the code as if it were a supported language
  2. Default setup automatically rewrites the code into a supported language
  3. That repository receives no CodeQL analysis and should use an alternative tool that uploads SARIF Correct answer.
  4. The organization-wide enablement fails and reverts on all repositories

Explanation

CodeQL supports a defined set of languages, so an unsupported repository cannot be analyzed by CodeQL and needs a third-party tool whose SARIF results are uploaded to code scanning. Code is not rewritten, enablement on other repositories is unaffected, and unsupported languages are not silently substituted.

Question 48GitHub Advanced Security (skills measured per exam study guide)

A team wants to block merging when a pull request introduces a new code scanning alert of high severity, while still allowing existing alerts. Which combination achieves this?

  1. Requiring signed commits on the protected branch
  2. Dismissing all existing alerts before each pull request
  3. A required code scanning check configured to fail on new high-severity results Correct answer.
  4. Enabling Dependabot version updates weekly

Explanation

Branch protection can require the code scanning check, and the analysis can be configured so only newly introduced results at or above a severity threshold cause failure. This preserves existing findings while gating new risk. Dismissal, commit signing, and version updates do not evaluate new alerts.

Question 49GitHub Advanced Security (skills measured per exam study guide)

A secret scanning alert shows a match for a generic pattern that the team believes is a test fixture. Which action best balances security and noise reduction?

  1. Disable secret scanning for the repository
  2. Delete the alert without review
  3. Verify the value is non-functional, then dismiss the alert with a reason or exclude the path in configuration Correct answer.
  4. Rotate the credential and close the repository

Explanation

Confirming the value is not a live credential and then dismissing with a documented reason or excluding the known test path reduces noise without weakening detection. Disabling the feature or deleting alerts without review removes the audit trail, and rotating a non-functional value is unnecessary.

Question 50GitHub Advanced Security (skills measured per exam study guide)

An organization wants CodeQL to run with a custom query pack across many repositories while allowing individual repositories to add extra queries. Which design is most maintainable?

  1. Ask developers to run the CodeQL CLI locally before pushing
  2. Publish a shared query pack and reference it in a reusable workflow or security configuration, letting repositories extend it Correct answer.
  3. Copy the query files into each repository manually
  4. Disable default setup and rely on manual uploads

Explanation

A published query pack centralizes query maintenance, and referencing it from a reusable workflow or security configuration propagates updates without per-repository copying. Manual copies drift, local CLI runs are unenforceable, and manual uploads lack consistency and coverage. Repositories can still layer additional queries.