An organization has a custom CodeQL workflow that is approved by the security team. They want to ensure that any changes to this workflow are reviewed and approved before they take effect. What is the best way to achieve this?

Make the workflow file read-only for all users except admins.

Use a GitHub Action that automatically reverts any changes to the workflow file.

Use branch protection rules to require pull request reviews for changes to the workflow file.

Send a notification to the security team when the workflow file changes.

Which of the following is a common method for managing approved custom CodeQL workflows across an organization?

Storing the workflow in a central repository and using a GitHub Actions workflow to copy it to other repositories

Requiring each repository to manually create its own workflow from scratch

Using GitHub's built-in 'Approved Workflows' feature that automatically enforces a single workflow for all repos

Disabling CodeQL for all repositories and using a third-party scanner instead

A team has a complex C++ project that requires a specific build command. They are using the default CodeQL workflow, but the analysis fails because the autobuild step cannot locate the build system. They need to fix this without rewriting the entire workflow. What should they do?

Remove the 'build-mode' line and rely on the default autobuild.

Set 'build-mode' to 'none' to skip the build step.

Change the 'language' matrix to include 'cpp' and hope the autobuild works.

Modify the workflow to set 'build-mode' to 'manual' and provide the correct 'build-command'.

A security team wants to audit which repositories have CodeQL enabled and which are using the default workflow versus a custom one. They need a programmatic way to gather this data across the organization. What should they use?

Use the GitHub GraphQL API to query for repositories and their code scanning alerts.

Use the GitHub REST API to fetch repository security settings and workflow files.

Manually check each repository's Security tab.

Use a GitHub Action that runs on a schedule and sends a report to the team.

GitHubAdvanced Security (GH-500)

Domain 6Objective 4

Manage CodeQL and Security Automation GH-500 Practice Questions (Page 4)

Part of the GitHub Security suites administration domain, which accounts for 10-15% of the GH-500 exam.

19questions here

4free pages

6concepts

10-15%of the exam

Questions 16–19

16application · medium
An organization has a custom CodeQL workflow that is approved by the security team. They want to ensure that any changes to this workflow are reviewed and approved before they take effect. What is the best way to achieve this?
Select an answer first
17foundation · easy
Which of the following is a common method for managing approved custom CodeQL workflows across an organization?
Select an answer first
18expert · hard
A team has a complex C++ project that requires a specific build command. They are using the default CodeQL workflow, but the analysis fails because the autobuild step cannot locate the build system. They need to fix this without rewriting the entire workflow. What should they do?
Select an answer first
19application · medium
A security team wants to audit which repositories have CodeQL enabled and which are using the default workflow versus a custom one. They need a programmatic way to gather this data across the organization. What should they use?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.