What does 'business impact' refer to when prioritizing security findings?

The severity score assigned by the scanner

The time required to remediate the vulnerability

The potential damage to the organization if the vulnerability is exploited

The number of developers needed to fix the issue

When configuring CodeQL analysis for a repository that contains both JavaScript and Python code, what must you specify?

Only the build mode, as it automatically detects languages

A single query suite that works for all languages

The languages to analyze and the query suites for each

The operating system for the runner

A development team uses CodeQL for C++ and Python. They want to run a custom query suite that includes all default security queries but excludes a specific query that produces false positives in their codebase. They also want to add a custom query that detects a company-specific vulnerability pattern. What should they create?

A single .qls file that includes the default security suite, excludes the problematic query, and includes the custom query.

A .qls file that includes the custom query and excludes the default suite entirely.

A .qls file that includes the default suite and the custom query, but excludes are not supported in .qls files.

Two separate .qls files: one for C++ and one for Python, each with different includes and excludes.

A large organization uses CodeQL for multiple languages. They have a custom query suite that includes a specific query for a C++ vulnerability. They also want to run a different suite for Python that excludes a query that is not relevant to their Python code. They want to minimize workflow complexity. What is the best approach?

Use the default security suite for both languages and add the C++ query as a separate step.

Create a single custom .qls file that includes the C++ query and excludes the Python query, and use it for all languages.

Create two separate .qls files: one for C++ and one for Python, and use a matrix in the workflow to apply the appropriate suite per language.

Use the security-extended suite for both languages and manually ignore irrelevant alerts.

Which of the following is an example of tailoring security detection to a compliance requirement?

Setting all alerts to high severity

Running only performance-related queries

Disabling all security queries to reduce noise

Enabling a query suite that checks for SQL injection in a payment processing application

GitHubAdvanced Security (GH-500)

Domain 5Objective 3

Customize and Optimize Security Detection GH-500 Practice Questions (Page 4)

Part of the Security operations: best practices, prioritization, and remediation domain, which accounts for 15-20% of the GH-500 exam.

21questions here

5free pages

6concepts

15-20%of the exam

Questions 16–20

16foundation · easy
What does 'business impact' refer to when prioritizing security findings?
Select an answer first
17foundation · easy
When configuring CodeQL analysis for a repository that contains both JavaScript and Python code, what must you specify?
Select an answer first
18application · medium
A development team uses CodeQL for C++ and Python. They want to run a custom query suite that includes all default security queries but excludes a specific query that produces false positives in their codebase. They also want to add a custom query that detects a company-specific vulnerability pattern. What should they create?
Select an answer first
19expert · hard
A large organization uses CodeQL for multiple languages. They have a custom query suite that includes a specific query for a C++ vulnerability. They also want to run a different suite for Python that excludes a query that is not relevant to their Python code. They want to minimize workflow complexity. What is the best approach?
Select an answer first
20foundation · easy
Which of the following is an example of tailoring security detection to a compliance requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.

Customize and Optimize Security Detection GH-500 Practice Questions (Page 4)

Questions 16–20

What does 'business impact' refer to when prioritizing security findings?

When configuring CodeQL analysis for a repository that contains both JavaScript and Python code, what must you specify?

Which of the following is an example of tailoring security detection to a compliance requirement?

Keep studying — Security operations: best practices, prioritization, and remediation