A team uses Semgrep for code scanning and wants to see the results in GitHub's Security tab. They have a workflow that runs Semgrep and produces a SARIF file. What is the next step to integrate the results?

Convert the SARIF file to a CodeQL database before uploading.

Create a GitHub issue for each Semgrep finding manually.

Use the `github/codeql-action/upload-sarif@v3` action to upload the SARIF file.

Use a Semgrep-specific action that automatically uploads results to the Security tab.

A large enterprise has a monorepo with code in C++, Java, and Python. They are evaluating code scanning tools. Their security team needs to write custom queries to detect internal coding standards violations. They have a budget for commercial tools but want to minimize the number of different tools. What is the most suitable approach?

Use CodeQL for all three languages, leveraging its query language to write custom rules.

Use Semgrep for Python and Java, and a separate commercial tool for C++.

Use SonarQube for all languages, as it has built-in rules for coding standards.

Use GitHub's default code scanning setup, which automatically selects the best tool for each language.

A developer is writing a script to upload a SARIF file to GitHub code scanning using the REST API. They have the SARIF file content and the commit SHA. What else is required to successfully upload the file?

The branch name where the commit is located.

The GitHub username of the developer running the script.

The name of the tool that generated the SARIF file.

The list of files changed in the commit.

A team uses SonarQube for code analysis and wants to integrate the results with GitHub code scanning. What is the recommended way to achieve this?

Manually copy the SonarQube results into a GitHub issue.

Use SonarQube's built-in GitHub integration that automatically syncs results.

Use the SonarQube GitHub Action to generate a SARIF file and upload it with the upload-sarif action.

Use the SonarQube API to directly create alerts in GitHub.

GitHubAdvanced Security (GH-500)

Domain 4Objective 1

Understand Code Scanning Approaches and Tooling GH-500 Practice Questions (Page 2)

Part of the Configure and use Code Security (formerly Code Scanning with CodeQL) domain, which accounts for 10-15% of the GH-500 exam.

24questions here

5free pages

5concepts

10-15%of the exam

Questions 6–10

6application · medium
A team uses Semgrep for code scanning and wants to see the results in GitHub's Security tab. They have a workflow that runs Semgrep and produces a SARIF file. What is the next step to integrate the results?
Select an answer first
7expert · hard
A large enterprise has a monorepo with code in C++, Java, and Python. They are evaluating code scanning tools. Their security team needs to write custom queries to detect internal coding standards violations. They have a budget for commercial tools but want to minimize the number of different tools. What is the most suitable approach?
Select an answer first
8application · medium
A developer is writing a script to upload a SARIF file to GitHub code scanning using the REST API. They have the SARIF file content and the commit SHA. What else is required to successfully upload the file?
Select an answer first
9application · medium
A team uses SonarQube for code analysis and wants to integrate the results with GitHub code scanning. What is the recommended way to achieve this?
Select an answer first
10foundation · medium
Which GitHub-native capability automatically detects hard-coded secrets, such as API keys and tokens, in repositories and alerts the relevant teams?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.

Understand Code Scanning Approaches and Tooling GH-500 Practice Questions (Page 2)

Questions 6–10

A team uses Semgrep for code scanning and wants to see the results in GitHub's Security tab. They have a workflow that runs Semgrep and produces a SARIF file. What is the next step to integrate the results?

A developer is writing a script to upload a SARIF file to GitHub code scanning using the REST API. They have the SARIF file content and the commit SHA. What else is required to successfully upload the file?

A team uses SonarQube for code analysis and wants to integrate the results with GitHub code scanning. What is the recommended way to achieve this?

Which GitHub-native capability automatically detects hard-coded secrets, such as API keys and tokens, in repositories and alerts the relevant teams?

Keep studying — Configure and use Code Security (formerly Code Scanning with CodeQL)