Set up and Configure Code Security GH-500 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A team has a repository with both Python and JavaScript code. They want to run code scanning on both languages using a single workflow. What is the best way to configure the workflow?

   • ACreate two separate workflows, one for each language.
   • BSet the language to 'python' and add a separate step to scan JavaScript.
   • CUse a matrix strategy with 'language: [python, javascript]' in the CodeQL workflow.
   • DUse the default workflow without specifying languages; it will auto-detect both.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A team has a JavaScript project that needs to be scanned with two different Node.js versions (14 and 16). They want to use a matrix strategy. What should they include in the matrix?

   • ASet 'node-version' as an environment variable and use it in the build step.
   • BCreate two separate workflows, one for each Node version.
   • CUse a matrix with 'os' and 'node-version' combined.
   • DInclude 'node-version: [14, 16]' and use it in the 'setup-node' step.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A team wants to run code scanning on both Ubuntu and Windows to catch platform-specific issues. They are using a matrix strategy. What should they include in the matrix?

   • AUse 'runs-on: ${{ matrix.os }}' but define the matrix in a separate file.
   • BSet 'runs-on: [ubuntu-latest, windows-latest]' directly.
   • CInclude 'os: [ubuntu-latest, windows-latest]' in the matrix and reference it in the 'runs-on' field.
   • DCreate two separate workflows, one for each OS.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A development team uses GitHub Actions for CI/CD. They want to enable code scanning for a Java repository that uses Maven. The team wants to run the scan on every push and also on a weekly schedule. Which workflow configuration should they use?

   • AEnable code scanning in the repository settings and configure the scan frequency in the security tab.
   • BUse the default template but remove the 'schedule' trigger and rely only on 'push' events.
   • CUse the default CodeQL workflow template, set the language matrix to include 'java', and add both 'push' and 'schedule' triggers.
   • DCreate a custom workflow that runs CodeQL only on a weekly schedule, without a push trigger, to minimize resource usage.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses a third-party SAST tool that generates SARIF output. They want to see these results in GitHub code scanning. What is the recommended way to integrate this?

   • AUpload the SARIF file using the GitHub API or a GitHub Action.
   • BConvert the SARIF to CodeQL format and run it in a workflow.
   • CUse the GitHub CLI to run the SAST tool.
   • DEnable code scanning in the repository settings and select the third-party tool.
   Reveal Solution Discussion Select an answer first