[Use Code Scanning with CodeQL]When using the advanced CodeQL code scanning setup, what is the name of the workflow file?
Answer(s): D
Comprehensive and Detailed Explanation;In the advanced setup for CodeQL code scanning, GitHub generates a workflow file named codeql- analysis.yml. This file is located in the .github/workflows directory of your repository. It defines the configuration for the CodeQL analysis, including the languages to analyze, the events that trigger the analysis, and the steps to perform during the workflow.
GitHub Docs Customizing your advanced setup for code scanning
[Configure and Use Secret Scanning]Which of the following statements best describes secret scanning push protection?
Answer(s): A
Comprehensive and Detailed Explanation;Secret scanning push protection is a proactive feature that scans for secrets in your code during the push process. If a secret is detected, the push is blocked, preventing the secret from being added to the repository. This helps prevent accidental exposure of sensitive information.GitHub Docs
GitHub Docs About push protection
[Configure and Use Dependency Management]In a private repository, what minimum requirements does GitHub need to generate a dependency graph? (Each answer presents part of the solution. Choose two.)
Answer(s): B,D
Comprehensive and Detailed Explanation;To generate a dependency graph for a private repository, GitHub requires:Dependency graph enabled: The repository must have the dependency graph feature enabled. This can be configured at the organization level to apply to all new private repositories.Access to manifest and lock files: GitHub needs read-only access to the repository's dependency manifest and lock files (e.g., package.json, requirements.txt) to identify and map dependencies.
GitHub Docs About the dependency graph
[Use Code Scanning with CodeQL]What does a CodeQL database of your repository contain?
Answer(s): B
Comprehensive and Detailed Explanation;A CodeQL database contains a representation of your codebase, including the build of the code and extracted data. This database is used to run CodeQL queries to analyze your code for potential vulnerabilities and errors.GitHub Docs
GitHub Docs Preparing your code for CodeQL analysis
[Use Code Scanning with CodeQL]When using CodeQL, how does extraction for compiled languages work?
Answer(s): C
For compiled languages, CodeQL performs extraction by monitoring the normal build process. This means it watches your usual build commands (like make, javac, or dotnet build) and extracts the relevant data from the actual build steps being executed. CodeQL uses this information to construct a semantic database of the application.This approach ensures that CodeQL captures a precise, real-world representation of the code and its behavior as it is compiled, including platform-specific configurations or conditional logic used during build.
GitHub Docs CodeQL for compiled languages
[Configure and Use Secret Scanning]Which of the following features helps to prioritize secret scanning alerts that present an immediate risk?
Secret validation checks whether a secret found in your repository is still valid and active with the issuing provider (e.g., AWS, GitHub, Stripe). If a secret is confirmed to be active, the alert is marked as verified, which means it's considered a high-priority issue because it presents an immediate security risk.This helps teams respond faster to valid, exploitable secrets rather than wasting time on expired or fake tokens.
GitHub Docs Secret validation in secret scanning
[Configure and Use Secret Scanning]What is a prerequisite to define a custom pattern for a repository?
You must enable secret scanning before defining custom patterns. Secret scanning provides the foundational capability for detecting exposed credentials, and custom patterns build upon that by allowing organizations to specify their own regex-based patterns for secrets unique to their environment.Without enabling secret scanning, GitHub will not process or apply custom patterns.
GitHub Docs Custom patterns in secret scanning
[Use Code Scanning with CodeQL]Where can you use CodeQL analysis for code scanning? (Each answer presents part of the solution.Choose two.)
Answer(s): B,C
In a workflow: GitHub Actions workflows are the most common place for CodeQL code scanning. The codeql-analysis.yml defines how the analysis runs and when it triggers.In an external CI system: GitHub allows you to run CodeQL analysis outside of GitHub Actions. Once complete, the results can be uploaded using the upload-sarif action to make alerts visible in the repository.You cannot run or trigger analysis from third-party repositories directly, and the Files changed tab in pull requests only shows diff -- not analysis results.
GitHub Docs Using CodeQL with CI and workflows
Post your Comments and Discuss Microsoft GH-500 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the GH-500 content, but please register or login to continue.