Customize and Optimize Security Detection GH-500 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A financial services company is required to comply with PCI DSS. They use GitHub Advanced Security. They want to prioritize CodeQL alerts that are most relevant to their compliance obligations, focusing on injection flaws and insecure cryptographic storage. They also want to reduce noise from alerts that are not directly tied to compliance. What should they do?

   • AEnable the security-extended suite to get more coverage, then filter alerts by severity.
   • BUse the default security suite and manually triage alerts to prioritize compliance-related ones.
   • CDisable all CodeQL alerts and rely on manual code reviews for compliance.
   • DCreate a custom query suite that includes only queries related to injection and cryptographic issues, and exclude other security queries.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of the 'build-mode' option in CodeQL analysis configuration?

   • ATo select the query suite to use
   • BTo specify how the code is built before analysis
   • CTo set the severity thresholds for alerts
   • DTo define the programming languages to analyze
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a monorepo with C, C++, and Python code. They want to run CodeQL analysis on all three languages, but they have different query suite requirements: security for C, security-extended for C++, and a custom suite for Python. They also want to minimize the number of workflow runs. What is the best approach?

   • AUse the default security suite for all languages and manually adjust alerts.
   • BUse a single workflow with a matrix that runs the init step for each language, specifying the appropriate query suite per language.
   • CUse a single init step with all languages and a single query suite that applies to all.
   • DRun three separate workflows, one per language, each with its own query suite.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company has a Go repository and wants to run CodeQL analysis. They want to use the default security suite but also want to ensure that the analysis is configured correctly for Go's build process. What should they do?

   • AUse the `autobuild` feature in the CodeQL workflow to automatically build the Go project.
   • BUse the `security-extended` suite instead of the default suite.
   • CManually specify the build command in the workflow, but this is only necessary for compiled languages like C++.
   • DDisable the build step because Go does not require a build.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A team wants to run CodeQL on a C# repository. They want to include all default security queries but also add a custom query that checks for a specific pattern they care about. They also want to exclude a default query that is known to produce false positives. What is the best way to configure this?

   • ACreate a separate workflow for the custom query and run it in addition to the default scan.
   • BCreate a custom .qls file that includes the default security suite, excludes the problematic query, and adds the custom query.
   • CUse the default security suite and add the custom query in the workflow, but you cannot exclude queries.
   • DUse the security-extended suite and manually ignore false positives in the UI.
   Reveal Solution Discussion Select an answer first