A developer is reviewing a code scanning alert for a command injection vulnerability. The alert details show an autofix suggestion. The developer is concerned that the autofix might change the behavior of the application. What is the best way to use the autofix suggestion?

Dismiss the alert because autofix is not trustworthy.

Apply the autofix directly to the main branch and push immediately.

Ignore the autofix and manually rewrite the code.

Apply the autofix in a branch and run the test suite before merging.

A security engineer is analyzing a code scanning alert for a cross-site scripting (XSS) vulnerability. The alert shows a dataflow path from a source to a sink, but the path goes through several functions that sanitize the input. The engineer needs to determine if the sanitization is sufficient. What should the engineer do?

Dismiss the alert because the path includes sanitization functions.

Re-run the code scanning analysis with a different query.

Examine the dataflow path in the 'Paths' tab and review each step for proper sanitization.

Adjust the severity of the alert to 'low' because sanitization is present.

Why might you adjust the severity of a code scanning alert?

To make the alert appear less frequently

To align the alert with your organization's risk priorities

To automatically fix the vulnerability

To hide the alert from other developers

When you dismiss a code scanning alert, what happens to it?

It is permanently deleted from the repository

It is marked as 'Dismissed' and can be viewed later

It is moved to a separate repository

What does the path visualization in a code scanning alert show?

The execution timeline of the program

The git commit history of the affected file

The network path between servers

The flow of data from source to sink through the code

GitHubAdvanced Security (GH-500)

Domain 4Objective 3

Analyze, Triage, and Remediate Code Scanning Results GH-500 Practice Questions (Page 1)

Part of the Configure and use Code Security (formerly Code Scanning with CodeQL) domain, which accounts for 10-15% of the GH-500 exam.

22questions here

5free pages

7concepts

10-15%of the exam

Questions 1–5

1application · medium
A developer is reviewing a code scanning alert for a command injection vulnerability. The alert details show an autofix suggestion. The developer is concerned that the autofix might change the behavior of the application. What is the best way to use the autofix suggestion?
Select an answer first
2expert · hard
A security engineer is analyzing a code scanning alert for a cross-site scripting (XSS) vulnerability. The alert shows a dataflow path from a source to a sink, but the path goes through several functions that sanitize the input. The engineer needs to determine if the sanitization is sufficient. What should the engineer do?
Select an answer first
3foundation · easy
Why might you adjust the severity of a code scanning alert?
Select an answer first
4foundation · easy
When you dismiss a code scanning alert, what happens to it?
Select an answer first
5foundation · easy
What does the path visualization in a code scanning alert show?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.