What is the purpose of the SARIF file in the context of code scanning?

It is a configuration file that defines the CodeQL queries to run.

It is a binary file that contains the compiled CodeQL database.

It is a log file that records the execution of the CI pipeline.

It is a standard format for exchanging static analysis results.

What is the main benefit of using GitHub's default code scanning workflow template?

It guarantees zero false positives in the scanning results.

It provides a pre-configured starting point that can be customized for the repository.

It eliminates the need for any manual configuration.

It automatically fixes all security vulnerabilities found.

A team has a repository with a mix of C and C++ code. They want to use CodeQL to scan both, but the build system is complex and requires a specific configuration. They are using the default workflow. What is the best way to ensure the build is correct?

Replace the autobuild step with a manual build step that runs the exact build commands.

Use the autobuild step and hope it works.

Use a matrix with 'language: [c, cpp]' and let autobuild handle each.

Use a custom CodeQL pack that includes the build configuration.

A team wants to customize the default CodeQL workflow to use a specific CodeQL pack for their C# project. What should they modify?

Change the 'language' matrix to include the pack.

Set the 'pack' field in the 'init' step to the desired pack.

Add a new step that runs the pack separately.

Set the 'queries' field to the pack name.

In a GitHub Actions workflow, which syntax is used to define a matrix of operating systems?

os: [ubuntu-latest, windows-latest]

runs-on: [ubuntu-latest, windows-latest]

strategy: matrix: os: [ubuntu-latest, windows-latest]

matrix: os: [ubuntu-latest, windows-latest]

GitHubAdvanced Security (GH-500)

Domain 4Objective 2

Set up and Configure Code Security GH-500 Practice Questions (Page 2)

Part of the Configure and use Code Security (formerly Code Scanning with CodeQL) domain, which accounts for 10-15% of the GH-500 exam.

24questions here

5free pages

6concepts

10-15%of the exam

Questions 6–10

6foundation · easy
What is the purpose of the SARIF file in the context of code scanning?
Select an answer first
7foundation · easy
What is the main benefit of using GitHub's default code scanning workflow template?
Select an answer first
8expert · hard
A team has a repository with a mix of C and C++ code. They want to use CodeQL to scan both, but the build system is complex and requires a specific configuration. They are using the default workflow. What is the best way to ensure the build is correct?
Select an answer first
9application · medium
A team wants to customize the default CodeQL workflow to use a specific CodeQL pack for their C# project. What should they modify?
Select an answer first
10foundation · easy
In a GitHub Actions workflow, which syntax is used to define a matrix of operating systems?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.