Optimize and Automate Code Security Operations GH-500 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A team wants to run CodeQL code scanning on a schedule to catch vulnerabilities that might be introduced by dependency updates, even when no code changes are pushed. They also want to avoid running the scan on every push to reduce resource usage. What is the best approach?

   • AUse the GitHub API to trigger the workflow after each dependency update.
   • BSet the `pull_request` trigger to run only on opened and reopened events.
   • CAdd a `schedule` trigger to the CodeQL workflow and remove the `push` trigger.
   • DKeep the `push` trigger and add a `workflow_dispatch` trigger for manual runs.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A team uses CodeQL for a JavaScript/TypeScript project. They want to exclude certain directories (e.g., `dist`, `node_modules`) from analysis to reduce noise and scan time. How should they configure this?

   • AAdd a `.github/codeql/config.yml` file with a `paths-ignore` section.
   • BSet the `languages` input to `javascript` only.
   • CAdd a `paths-ignore` entry in the workflow YAML under the `codeql-action/init` step.
   • DUse the `queries` input to exclude the directories.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A team uses CodeQL on a large monorepo with multiple languages. They want to reduce scan time by running the analysis only on changed files. However, they are concerned that this might miss vulnerabilities in files that are not changed but are affected by the changes. What is the best approach?

   • ARun the full scan on a schedule and use the `paths` filter for pull requests.
   • BIncrease the `ram` and `threads` inputs to speed up the full scan.
   • CUse the `paths-ignore` filter to exclude unchanged files.
   • DUse the `paths` filter to run the scan only on changed files.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A team wants to run a custom query that is stored in a separate repository. They have added the repository to the `pack` input in the `init` step. However, the scan fails because the query pack cannot be found. What is the most likely cause?

   • AThe repository is private and the workflow does not have access.
   • BThe query pack is not in the default branch.
   • CThe `pack` input should be `queries` instead.
   • DThe query pack is not published to the GitHub Packages registry.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A CodeQL scan fails during the build step for a C++ project with the error: 'No source code was seen during the build.' The project uses CMake. What is the most likely cause and fix?

   • AThe build command is not being run; add the `build` step to the workflow.
   • BThe source code is in a subdirectory; set the `source-root` input to the correct path.
   • CThe workflow is running on a Windows runner; switch to Ubuntu.
   • DThe `autobuild` step is failing to detect the build system; use a custom build command with `cmake --build .`.
   Reveal Solution Discussion Select an answer first