A development team uses a monorepo with both JavaScript and Python code. They want CodeQL to analyze both languages, but the default workflow only detected JavaScript. They need to ensure Python is also analyzed. What should they do?

Change the 'on' trigger to include 'workflow_dispatch' so the workflow can be manually triggered.

Set the 'build-mode' to 'none' for the entire workflow.

Add a separate workflow file for Python that runs on a different schedule.

Modify the custom workflow's 'language' matrix to include 'python' and 'javascript'.

When enabling CodeQL at scale across many repositories, what is a key advantage of using the GitHub API over manually editing each repository?

It automatically fixes any build failures in the repositories

It provides a graphical interface for managing repositories

It bypasses the need for GitHub Actions to run the analysis

It allows you to apply the same configuration to multiple repositories quickly and consistently

An organization wants to enforce that all repositories use an approved CodeQL workflow that includes a specific query pack and a custom build step. They want to prevent developers from modifying the workflow. What is the most effective way to enforce this?

Use branch protection rules to require the workflow to pass before merging.

Send a notification to repository admins asking them to manually review the workflow.

Create a repository template that includes the approved workflow.

Use a GitHub Action that checks the workflow file content and fails if it does not match the approved version.

GitHubAdvanced Security (GH-500)

Domain 6Objective 4

Manage CodeQL and Security Automation GH-500 Practice Questions (Page 1)

Part of the GitHub Security suites administration domain, which accounts for 10-15% of the GH-500 exam.

19questions here

4free pages

6concepts

10-15%of the exam

Questions 1–5

1foundation · easy
In a custom CodeQL workflow, which YAML key is used to specify the query suites or query files that CodeQL should run?
Select an answer first
2foundation · easy
Which GitHub API is specifically designed to query and mutate data using a flexible, graph-based syntax, including security configuration settings?
Select an answer first
3application · medium
A development team uses a monorepo with both JavaScript and Python code. They want CodeQL to analyze both languages, but the default workflow only detected JavaScript. They need to ensure Python is also analyzed. What should they do?
Select an answer first
4foundation · easy
When enabling CodeQL at scale across many repositories, what is a key advantage of using the GitHub API over manually editing each repository?
Select an answer first
5application · medium
An organization wants to enforce that all repositories use an approved CodeQL workflow that includes a specific query pack and a custom build step. They want to prevent developers from modifying the workflow. What is the most effective way to enforce this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.

Manage CodeQL and Security Automation GH-500 Practice Questions (Page 1)

Questions 1–5

In a custom CodeQL workflow, which YAML key is used to specify the query suites or query files that CodeQL should run?

Which GitHub API is specifically designed to query and mutate data using a flexible, graph-based syntax, including security configuration settings?

A development team uses a monorepo with both JavaScript and Python code. They want CodeQL to analyze both languages, but the default workflow only detected JavaScript. They need to ensure Python is also analyzed. What should they do?

When enabling CodeQL at scale across many repositories, what is a key advantage of using the GitHub API over manually editing each repository?

An organization wants to enforce that all repositories use an approved CodeQL workflow that includes a specific query pack and a custom build step. They want to prevent developers from modifying the workflow. What is the most effective way to enforce this?

Keep studying — GitHub Security suites administration