A code scanning alert was dismissed as 'won't fix' six months ago. A developer has now made changes to the code that could affect the vulnerability. The developer wants to know if the alert should be re-evaluated. What is the best course of action?

Wait for the next code scanning run to see if a new alert appears.

Create a new issue for the alert without re-opening it.

Re-open the alert and re-triage it based on the new code changes.

Leave the alert dismissed because the reason is still valid.

What happens to a code scanning alert when the code that triggered it is fixed and the change is pushed?

The alert is deleted from the repository

The alert remains 'Open' until manually dismissed

The alert transitions to 'Dismissed'

The alert automatically transitions to 'Closed'

A developer is looking at a code scanning alert for a buffer overflow. The alert details show the affected code, but the developer is unsure which part of the code is the source of the untrusted data. What should the developer look at in the alert details?

The 'Location' field to see the file and line number.

The 'Tags' section to see the alert's metadata.

The 'Rule' description to understand the vulnerability type.

The 'Paths' tab to see the dataflow from source to sink.

GitHubAdvanced Security (GH-500)

Domain 4Objective 3

Analyze, Triage, and Remediate Code Scanning Results GH-500 Practice Questions (Page 3)

Part of the Configure and use Code Security (formerly Code Scanning with CodeQL) domain, which accounts for 10-15% of the GH-500 exam.

22questions here

5free pages

7concepts

10-15%of the exam

Questions 11–15

11expert · hard
A code scanning alert was dismissed as 'won't fix' six months ago. A developer has now made changes to the code that could affect the vulnerability. The developer wants to know if the alert should be re-evaluated. What is the best course of action?
Select an answer first
12foundation · easy
What happens to a code scanning alert when the code that triggered it is fixed and the change is pushed?
Select an answer first
13foundation · easy
When reviewing a code scanning alert in the GitHub UI, which section provides the exact lines of code that triggered the alert?
Select an answer first
14foundation · easy
Which of the following is a valid state for a code scanning alert?
Select an answer first
15application · medium
A developer is looking at a code scanning alert for a buffer overflow. The alert details show the affected code, but the developer is unsure which part of the code is the source of the untrusted data. What should the developer look at in the alert details?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.

Analyze, Triage, and Remediate Code Scanning Results GH-500 Practice Questions (Page 3)

Questions 11–15

A code scanning alert was dismissed as 'won't fix' six months ago. A developer has now made changes to the code that could affect the vulnerability. The developer wants to know if the alert should be re-evaluated. What is the best course of action?

What happens to a code scanning alert when the code that triggered it is fixed and the change is pushed?

When reviewing a code scanning alert in the GitHub UI, which section provides the exact lines of code that triggered the alert?

Which of the following is a valid state for a code scanning alert?

A developer is looking at a code scanning alert for a buffer overflow. The alert details show the affected code, but the developer is unsure which part of the code is the source of the untrusted data. What should the developer look at in the alert details?

Keep studying — Configure and use Code Security (formerly Code Scanning with CodeQL)