A security team wants to enable CodeQL scanning on a new repository with minimal configuration. They need the default setup to run on every push and pull request, and they want to avoid writing a custom workflow from scratch. What should they do?

Use the GitHub UI to enable CodeQL scanning, which automatically creates the default workflow file.

Install the CodeQL CLI locally and run it manually after each commit.

Create a custom workflow using the codeql-action/init action with a manually specified build command.

Add a .github/workflows/codeql.yml file with only the 'on: [push, pull_request]' trigger and no other settings.

A security admin needs to enable CodeQL scanning on over 200 repositories in an organization. They want to use a consistent configuration and avoid manual UI clicks. What is the most efficient approach?

Create a GitHub Action that runs on a schedule and enables CodeQL for all repositories.

Use the GitHub REST API to update each repository's security settings and create the workflow file via a script.

Manually enable CodeQL in each repository through the Security tab.

Use the GraphQL API to query repositories and then manually create workflow files.

An organization has a policy that all CodeQL workflows must use a specific query pack and must not use the 'pull_request' trigger to avoid duplicate scans. They want to automate the enforcement of this policy across all repositories. What is the best way to implement this?

Send an email to developers explaining the policy.

Create a GitHub Action that checks the workflow file for the required query pack and trigger, and fails if not compliant.

Use the GitHub REST API to update all workflow files to the approved version.

Use branch protection to require a code review for any changes to workflow files.

What is the primary purpose of implementing approved custom CodeQL workflows across an organization?

To ensure all repositories use a consistent, vetted CodeQL configuration that meets security and compliance standards

To allow each developer to customize their own CodeQL queries without oversight

To automatically fix all security vulnerabilities found by CodeQL

To reduce the number of repositories using CodeQL by limiting it to approved teams

An organization wants to audit CodeQL usage across all repositories. They need to know which repositories have CodeQL enabled, which use the default workflow, and which have custom workflows. They also want to identify repositories that have not run CodeQL in the last 30 days. What is the most efficient way to gather this information?

Use the GraphQL API to query for repositories and their code scanning alerts.

Use a GitHub Action that runs on a schedule and sends a report to the team.

Use the REST API to fetch repository security settings, workflow files, and code scanning analyses.

Manually check each repository's Security tab and Actions tab.

GitHubAdvanced Security (GH-500)

Domain 6Objective 4

Manage CodeQL and Security Automation GH-500 Practice Questions (Page 2)

Part of the GitHub Security suites administration domain, which accounts for 10-15% of the GH-500 exam.

19questions here

4free pages

6concepts

10-15%of the exam

Questions 6–10

6application · medium
A security team wants to enable CodeQL scanning on a new repository with minimal configuration. They need the default setup to run on every push and pull request, and they want to avoid writing a custom workflow from scratch. What should they do?
Select an answer first
7application · medium
A security admin needs to enable CodeQL scanning on over 200 repositories in an organization. They want to use a consistent configuration and avoid manual UI clicks. What is the most efficient approach?
Select an answer first
8application · medium
An organization has a policy that all CodeQL workflows must use a specific query pack and must not use the 'pull_request' trigger to avoid duplicate scans. They want to automate the enforcement of this policy across all repositories. What is the best way to implement this?
Select an answer first
9foundation · easy
What is the primary purpose of implementing approved custom CodeQL workflows across an organization?
Select an answer first
10expert · hard
An organization wants to audit CodeQL usage across all repositories. They need to know which repositories have CodeQL enabled, which use the default workflow, and which have custom workflows. They also want to identify repositories that have not run CodeQL in the last 30 days. What is the most efficient way to gather this information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.