Hard GH-500 practice questions

A security engineer maintains a repository where two separate CodeQL analysis workflows run against the same branch: one performs a fast, targeted scan on every pull request, and another runs a deeper, extended-query scan on a nightly schedule. Both workflows upload SARIF results to GitHub code scanning. After enabling the nightly workflow, the engineer notices that the nightly results are overwriting the pull request scan results, causing alerts to appear and disappear inconsistently. What is the correct way to ensure both sets of results are tracked independently without overwriting each other?

A security lead at a fintech company wants CodeQL code scanning to block pull requests only when a newly introduced alert has a 'critical' or 'high' severity, while allowing lower-severity alerts to be merged after review. Developers should still see all alerts in the PR conversation. Which configuration best achieves this outcome?

A platform security team wants to enforce a consistent remediation SLA across 40 repositories: any open code scanning alert with a security severity of 'critical' or 'high' must block deployment to production, while medium and low alerts should only generate warnings. They also need the enforcement to survive when individual repository admins try to loosen their local branch protection settings. Which approach best meets these requirements at scale?

A security engineer is triaging the code scanning alert backlog for a critical payment service. Two open CodeQL alerts compete for immediate attention: Alert 1 is tagged with a security-severity score of 9.1 (Critical) but has a low occurrence count, while Alert 2 shows a code-scanning severity of 'error' but carries no security-severity metadata because it comes from a code-quality query. The team's remediation ruleset gates merges based on security-severity thresholds. Which alert should the engineer prioritize for remediation first, and why?

A team maintains a large Java service and wants to add CodeQL analysis via GitHub Actions advanced setup. Their build system uses a proprietary Gradle plugin that frequently fails in the default autobuild step, causing the CodeQL database creation to error out before analysis. They want CodeQL to analyze the Java code without executing their build. Which configuration change should they make in the CodeQL workflow?

Your security team maintains a shared CodeQL query pack published to GitHub Packages that contains organization-specific security queries. You are using advanced setup and want the code scanning workflow for a JavaScript repository to run the built-in security-and-quality suite PLUS your custom query pack, while excluding one noisy built-in query by its query ID. Which approach correctly accomplishes all three requirements?

A security architect at a fintech company wants CodeQL analysis to reflect the organization's elevated risk tolerance for injection and cryptographic weaknesses, while suppressing noisy maintainability-related alerts that developers routinely ignore. The team already runs default setup across 200 repositories but finds the standard query set produces too many low-value results and misses some deeper security patterns. Which approach best tailors detection to the organization's risk profile without abandoning centralized management?

A platform engineering team at a financial services company is enabling CodeQL default setup across 400 repositories in GitHub Enterprise Cloud. Compliance requires that all CodeQL analysis run on the company's own infrastructure inside a locked-down network segment, and that no analysis workloads execute on GitHub-hosted runners. An enterprise owner asks how to ensure the org-wide CodeQL rollout meets this requirement while still using the automatically managed default setup where possible. What should they do?

An enterprise owner has enabled an allowlist of approved GitHub Actions. A security engineer wants organizations to use a shared, centrally maintained custom CodeQL workflow (rather than default setup) so that all repositories analyze code with the organization's mandated query pack. The custom workflow lives in a reusable-workflow repository and is called via a `uses:` reference. Developers report that when they add the reusable workflow reference to their repos, the CodeQL scan job never runs and Actions reports the workflow is not permitted. What is the MOST likely cause and correct remediation?

A platform security lead wants to enforce a single organization-wide policy that (1) blocks pull requests introducing code scanning alerts of 'high' security severity or above, and (2) prevents merges when Dependabot detects a 'critical' vulnerability in a new dependency. They want this enforced consistently across dozens of repositories without configuring each repo individually. Which GitHub capability best achieves this cross-suite enforcement from a single point of control?

A security team at a fintech company wants developers to be blocked from merging pull requests that introduce new high-severity code scanning alerts, but they also need a controlled escape hatch: when a genuine business emergency requires a hotfix, a specific group of designated security reviewers should be able to approve the exception rather than any developer simply overriding the block. The team wants this handled natively through GitHub's enforcement mechanisms without disabling the protection entirely. Which approach best meets these requirements?

A platform team builds Java services with Gradle, where many runtime dependencies are only resolved during the build and are not listed explicitly in the checked-in build files. The security lead notices that GitHub's dependency graph for these repositories misses these transitively resolved dependencies, so Dependabot alerts are incomplete. Which approach lets GitHub include the full, build-resolved dependency set in the dependency graph?

A platform team enforces the Dependency Review Action on all repositories with a policy to fail any pull request introducing a dependency with a 'high' or 'critical' vulnerability. A development team is blocked by a specific critical advisory (GHSA-xxxx-yyyy-zzzz) in a transitive dependency that has no available patch, but their security team has assessed the vulnerable code path as unreachable and approved a temporary exception. The team wants their PRs to pass the check for only this one advisory while keeping the strict severity gate active for all other vulnerabilities. Which Dependency Review Action configuration option should they use?

At Meridian Corp, an enterprise owner has created a security configuration at the enterprise level and applied it to all organizations. Priya is assigned the security manager role in the 'Payments' organization. She needs to create an additional organization-level security configuration that enables Dependabot version updates for repositories that handle PCI data, and apply it to those repos. However, when she attempts this, she finds she can create the org-level configuration but a subset of settings is locked and cannot be overridden. What best explains this behavior and what she can do?

You are the enterprise administrator for a GitHub Enterprise Cloud instance with 40 organizations and over 5,000 repositories. Leadership wants Code Security (CodeQL default setup) and Secret Protection enabled consistently, with the ability to report on which repositories have applied the settings. You need a repeatable, auditable method that does not require org owners to configure each repository manually. Which approach best meets these requirements?

You are an enterprise owner for a GitHub Enterprise Cloud account. You created an enterprise-level security configuration that enables Dependabot alerts, secret scanning, and push protection, and you applied it to all organizations with the enforcement set so organizations cannot override it. One organization owner reports they need to disable push protection for a small set of legacy repositories that generate excessive false-positive blocks during migration. What is the correct way to accommodate this while keeping enterprise governance intact?

Your organization's dependency scanning has raised several Dependabot alerts across multiple repositories, all linked to a single GitHub Security Advisory (GHSA). Three days later, a security engineer notices that the upstream advisory has been marked as 'Withdrawn' in the GitHub Advisory Database, with a note that the vulnerability report was determined to be invalid. Some teams have already started upgrading the dependency. What is the most appropriate remediation-workflow response?

Your security team faces a backlog of 400+ Dependabot alerts across a large service. Leadership wants a repeatable remediation prioritization approach that focuses engineering effort where the real-world risk is highest, rather than blindly working from raw CVSS base scores. Which prioritization approach best reflects GitHub Advanced Security best practices for reducing exploitable risk first?

A security engineer at your company discovers that a valid AWS access key was committed months ago and triggered a secret scanning alert. They immediately revoke the key in AWS, rotate credentials, and mark the alert as 'Revoked' in GitHub. Two weeks later, an automated audit shows the same secret string still exists in the repository's Git history on the default branch. What is the correct understanding of the alert's state and the appropriate next action?

You are a platform engineer for a company on GitHub Enterprise Cloud. The enterprise owner has applied an enterprise-level security configuration that enables secret scanning push protection and sets it as the default for all new and existing repositories across every organization. Separately, an organization owner in one of the child organizations creates and applies their own organization-level security configuration that leaves push protection disabled, intending to roll it out gradually. A developer reports that push protection is still blocking commits in a repository within that organization. Assuming the enterprise configuration was applied with enforcement, why is push protection still active despite the organization's configuration?

A financial services organization uses a code scanning severity ruleset that blocks merges when a high-severity alert exists. A team lead requests a permanent exception for one repository, arguing that a specific alert is a false positive tied to a legacy internal library. As the security manager responsible for governance, you want to grant relief without permanently weakening the control or losing visibility. Which approach best balances developer velocity with ongoing governance?