Understand Code Scanning Approaches and Tooling GH-500 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An organization uploads SARIF files from multiple tools. They notice that the same vulnerability is reported by two different tools. How does GitHub handle this?

   • AGitHub deduplicates the alerts and shows only one.
   • BGitHub rejects the second upload to avoid duplicates.
   • CGitHub shows both alerts, as they are from different tools.
   • DGitHub merges the alerts into a single alert with a combined description.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization uses a third-party static analysis tool that outputs results in SARIF format. They want to see these results in the GitHub Security tab alongside CodeQL alerts. They have a GitHub Actions workflow that runs the tool. What is the correct way to upload the results?

   • AUse the `actions/upload-artifact@v4` action to save the SARIF file as a build artifact.
   • BUse the `github/codeql-action/upload-sarif@v3` action in the workflow, specifying the path to the SARIF file.
   • CUse the GitHub REST API to create a new issue for each finding in the SARIF file.
   • DCommit the SARIF file to the repository and create a pull request to trigger a scan.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has a large C++ codebase and a small Python service. They are evaluating code scanning tools. They need to scan both languages and want to minimize the number of tools. They also have a requirement to write custom rules for C++. What is the most efficient approach?

   • AUse CodeQL for both languages, as it supports C++ and Python and allows custom queries.
   • BUse CodeQL for C++ and a third-party tool for Python.
   • CUse Semgrep for Python and a commercial C++ tool.
   • DUse SonarQube for both languages, as it has built-in rules for C++.
   Reveal Solution Discussion Select an answer first
5. 19foundation · medium

   When multiple SARIF files are uploaded for the same commit in a repository, how does GitHub handle the results?

   • AGitHub displays each upload as a separate alert set without merging
   • BGitHub merges the results from all uploads and deduplicates identical findings
   • CGitHub keeps only the most recent upload and discards all previous ones
   • DGitHub rejects any upload after the first one for a commit
   Reveal Solution Discussion Select an answer first
6. 20foundation · medium

   How does GitHub's native CodeQL code scanning integrate with GitHub Actions to analyze code?

   • ACodeQL runs only on GitHub's servers without any user-defined workflow or configuration.
   • BCodeQL runs as a standalone service that uploads results to GitHub via the API without using Actions.
   • CCodeQL analysis is triggered by a GitHub Actions workflow that builds the code, runs queries, and uploads SARIF results to the repository.
   • DCodeQL requires a third-party CI system to execute and then pushes results to GitHub.
   Reveal Solution Discussion Select an answer first