A company uses a self-hosted CI system that runs in a restricted network. They want to upload SARIF results to GitHub, but the CI system cannot directly access the GitHub API. What is a viable solution?

Use a GitHub App installation token and upload via the API from a different network.

Manually upload the SARIF file through the GitHub web interface.

Use a GitHub Actions workflow that runs on a schedule and pulls the SARIF file from a shared location.

Use the GitHub CLI from the CI system to upload the SARIF file.

A team wants to use the 'security-extended' query suite in addition to the default queries. How should they configure the workflow?

Change the 'pack' field to 'security-extended'.

Set 'queries: security-extended' in the 'init' step.

Use the 'security-and-quality' suite instead.

Add a separate step to run the 'security-extended' suite.

Where can a user find the default code scanning workflow templates provided by GitHub?

In the GitHub API, under the 'code-scanning' endpoint.

In the repository's 'Actions' tab, under 'Workflow templates'.

In the GitHub Marketplace, under 'Code scanning templates'.

In the 'Security' tab of the repository, under 'Code scanning'.

A team wants to use the default CodeQL workflow template but needs to customize the queries to include additional security queries from a private repository. What should they modify in the workflow?

Use the 'security-extended' query suite instead of the default.

Add a new step that runs the additional queries separately.

Modify the 'pack' field to include the private repository.

Change the 'queries' field in the 'init' step to reference the private repository.

GitHubAdvanced Security (GH-500)

Domain 4Objective 2

Set up and Configure Code Security GH-500 Practice Questions (Page 1)

Part of the Configure and use Code Security (formerly Code Scanning with CodeQL) domain, which accounts for 10-15% of the GH-500 exam.

24questions here

5free pages

6concepts

10-15%of the exam

Questions 1–5

1foundation · easy
Which cron expression would schedule a code scanning workflow to run every day at midnight UTC?
Select an answer first
2expert · hard
A company uses a self-hosted CI system that runs in a restricted network. They want to upload SARIF results to GitHub, but the CI system cannot directly access the GitHub API. What is a viable solution?
Select an answer first
3application · medium
A team wants to use the 'security-extended' query suite in addition to the default queries. How should they configure the workflow?
Select an answer first
4foundation · easy
Where can a user find the default code scanning workflow templates provided by GitHub?
Select an answer first
5application · medium
A team wants to use the default CodeQL workflow template but needs to customize the queries to include additional security queries from a private repository. What should they modify in the workflow?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.