A CodeQL scan for a C++ project fails with the error: 'The build step failed because the build command was not found.' The project uses a custom build script located in the repository. What is the most likely cause and fix?

The build command is not specified in the workflow; use the `build` input to specify the script.

The build script is in a subdirectory; set the `source-root` input to the correct path.

The workflow is running on a Windows runner; switch to Ubuntu.

The build script is not executable; add `chmod +x` to the workflow.

A team wants to customize CodeQL analysis for a Kotlin project. They want to exclude certain packages from the analysis to reduce noise. What is the best way to achieve this?

Use a custom query suite that filters out the packages.

Use the `paths-ignore` input in the workflow to exclude the packages.

Use the `build-mode` input to skip the packages.

Set the `languages` input to `kotlin` only.

A development team uses CodeQL code scanning on a large Java monorepo. The default analysis takes over an hour and frequently times out. They want to reduce scan time while still covering the most critical code paths. They decide to run the scan only on pull requests that modify files in the core modules. Which configuration change should they make?

Add a `paths-ignore` filter to exclude test files from the scan.

Change the `languages` input to only include Java.

Increase the `concurrency` setting in the workflow to run multiple scans in parallel.

Set the `paths` filter in the CodeQL workflow to include only the core module directories.

A security team wants to enforce a custom set of CodeQL queries for all repositories in their organization. They have created a private query pack and want to ensure it runs alongside the default security queries. What is the most maintainable way to configure this?

Add the query pack to the `queries` array in each repository's codeql-config.yml file.

Fork the CodeQL repository and replace the default queries with the custom pack.

Use the GitHub API to programmatically add the query pack to every repository's workflow.

Create a shared configuration file in a central repository and reference it from each workflow using `config-file`.

GitHubAdvanced Security (GH-500)

Domain 4Objective 4

Optimize and Automate Code Security Operations GH-500 Practice Questions (Page 1)

Part of the Configure and use Code Security (formerly Code Scanning with CodeQL) domain, which accounts for 10-15% of the GH-500 exam.

12questions here

3free pages

5concepts

10-15%of the exam

Questions 1–5

1expert · medium
A CodeQL scan for a C++ project fails with the error: 'The build step failed because the build command was not found.' The project uses a custom build script located in the repository. What is the most likely cause and fix?
Select an answer first
2expert · medium
A team wants to customize CodeQL analysis for a Kotlin project. They want to exclude certain packages from the analysis to reduce noise. What is the best way to achieve this?
Select an answer first
3application · medium
A development team uses CodeQL code scanning on a large Java monorepo. The default analysis takes over an hour and frequently times out. They want to reduce scan time while still covering the most critical code paths. They decide to run the scan only on pull requests that modify files in the core modules. Which configuration change should they make?
Select an answer first
4application · medium
A security team wants to enforce a custom set of CodeQL queries for all repositories in their organization. They have created a private query pack and want to ensure it runs alongside the default security queries. What is the most maintainable way to configure this?
Select an answer first
5foundation · easy
In a GitHub Actions workflow that runs CodeQL, which file is used to define custom queries or query packs for the analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.

Optimize and Automate Code Security Operations GH-500 Practice Questions (Page 1)

Questions 1–5

A CodeQL scan for a C++ project fails with the error: 'The build step failed because the build command was not found.' The project uses a custom build script located in the repository. What is the most likely cause and fix?

A team wants to customize CodeQL analysis for a Kotlin project. They want to exclude certain packages from the analysis to reduce noise. What is the best way to achieve this?

A security team wants to enforce a custom set of CodeQL queries for all repositories in their organization. They have created a private query pack and want to ensure it runs alongside the default security queries. What is the most maintainable way to configure this?

In a GitHub Actions workflow that runs CodeQL, which file is used to define custom queries or query packs for the analysis?

Keep studying — Configure and use Code Security (formerly Code Scanning with CodeQL)