A team runs two different code scanning tools in their CI pipeline. Both tools generate SARIF files for the same commit. They want to see all results in the GitHub Security tab. What is the correct approach?

Combine the two SARIF files into one file manually before uploading.

Upload both SARIF files in the same workflow run using the upload-sarif action for each.

Upload the second SARIF file to a different branch to avoid conflicts.

Upload only the first SARIF file, as GitHub only supports one tool's results per commit.

A company wants to enable code scanning on a repository that contains only C# code. They want to use GitHub's native solution. What is the most straightforward way to achieve this?

Use GitHub's secret scanning to find vulnerabilities in the C# code.

Manually run CodeQL CLI on a local machine and upload the results via the API.

Create a custom workflow that uses a third-party C# analyzer and uploads its SARIF output.

Enable the default CodeQL setup from the repository's Security tab.

A developer is uploading a SARIF file to GitHub code scanning. The file contains results for a file that is in a different repository. What will happen?

The upload will fail because the SARIF file must reference files in the same repository.

The results will be displayed in both repositories.

The upload will succeed, but the results will be marked as 'not applicable'.

The results will be ignored for the other repository and only shown in the current one.

A team uploads a SARIF file that contains multiple alerts for the same vulnerability in the same location. They notice that the Security tab shows only one alert. What is the reason for this?

The SARIF file is invalid because it contains duplicate alerts.

GitHub combines all alerts into a single alert with a summary.

GitHub deduplicates identical alerts based on the rule ID and location.

GitHub only shows the first alert in the file and ignores the rest.

GitHubAdvanced Security (GH-500)

Domain 4Objective 1

Understand Code Scanning Approaches and Tooling GH-500 Practice Questions (Page 1)

Part of the Configure and use Code Security (formerly Code Scanning with CodeQL) domain, which accounts for 10-15% of the GH-500 exam.

24questions here

5free pages

5concepts

10-15%of the exam

Questions 1–5

1application · medium
A team runs two different code scanning tools in their CI pipeline. Both tools generate SARIF files for the same commit. They want to see all results in the GitHub Security tab. What is the correct approach?
Select an answer first
2foundation · medium
When deciding between CodeQL and a third-party tool like Semgrep for a new project, which factor is most directly related to the programming languages used in the repository?
Select an answer first
3application · medium
A company wants to enable code scanning on a repository that contains only C# code. They want to use GitHub's native solution. What is the most straightforward way to achieve this?
Select an answer first
4application · medium
A developer is uploading a SARIF file to GitHub code scanning. The file contains results for a file that is in a different repository. What will happen?
Select an answer first
5expert · hard
A team uploads a SARIF file that contains multiple alerts for the same vulnerability in the same location. They notice that the Security tab shows only one alert. What is the reason for this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.