A startup's codebase is primarily Python with a small amount of JavaScript. They want to scan for security vulnerabilities in pull requests. They have a limited budget and want to minimize maintenance overhead. The team is already familiar with GitHub Actions. What is the most appropriate approach?

Run a custom script in Actions that uses the CodeQL CLI to analyze only the JavaScript code, as Python analysis is not supported.

Use SonarQube's cloud service and configure it to post results to the pull request, bypassing GitHub Actions entirely.

Integrate Semgrep via a third-party action for Python and JavaScript, and write custom rules for all security checks.

Configure GitHub's default CodeQL analysis to run on pull requests for both Python and JavaScript.

Which GitHub Actions action is commonly used to upload SARIF files to GitHub code scanning?

github/codeql-action/upload-sarif

An organization uploads SARIF files from two different tools. One tool reports a vulnerability in a file that has been deleted in the latest commit. What will GitHub code scanning do with this alert?

It will automatically create a new issue for the alert.

It will still display the alert, but mark it as stale or no longer applicable.

It will keep the alert open indefinitely until the file is restored.

It will reject the entire SARIF upload because the file is missing.

GitHubAdvanced Security (GH-500)

Domain 4Objective 1

Understand Code Scanning Approaches and Tooling GH-500 Practice Questions (Page 5)

Part of the Configure and use Code Security (formerly Code Scanning with CodeQL) domain, which accounts for 10-15% of the GH-500 exam.

24questions here

5free pages

5concepts

10-15%of the exam

Questions 21–24

21foundation · medium
Which of the following is a common third-party static analysis tool that can be integrated with GitHub code scanning?
Select an answer first
22application · medium
A startup's codebase is primarily Python with a small amount of JavaScript. They want to scan for security vulnerabilities in pull requests. They have a limited budget and want to minimize maintenance overhead. The team is already familiar with GitHub Actions. What is the most appropriate approach?
Select an answer first
23foundation · medium
Which GitHub Actions action is commonly used to upload SARIF files to GitHub code scanning?
Select an answer first
24expert · hard
An organization uploads SARIF files from two different tools. One tool reports a vulnerability in a file that has been deleted in the latest commit. What will GitHub code scanning do with this alert?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.

Understand Code Scanning Approaches and Tooling GH-500 Practice Questions (Page 5)

Questions 21–24

Which of the following is a common third-party static analysis tool that can be integrated with GitHub code scanning?

A startup's codebase is primarily Python with a small amount of JavaScript. They want to scan for security vulnerabilities in pull requests. They have a limited budget and want to minimize maintenance overhead. The team is already familiar with GitHub Actions. What is the most appropriate approach?

Which GitHub Actions action is commonly used to upload SARIF files to GitHub code scanning?

An organization uploads SARIF files from two different tools. One tool reports a vulnerability in a file that has been deleted in the latest commit. What will GitHub code scanning do with this alert?

Keep studying — Configure and use Code Security (formerly Code Scanning with CodeQL)