Configure and use Code Security — GH-500 Practice Quiz

Question 1

A security engineer maintains a repository where two separate CodeQL analysis workflows run against the same branch: one performs a fast, targeted scan on every pull request, and another runs a deeper, extended-query scan on a nightly schedule. Both workflows upload SARIF results to GitHub code scanning. After enabling the nightly workflow, the engineer notices that the nightly results are overwriting the pull request scan results, causing alerts to appear and disappear inconsistently. What is the correct way to ensure both sets of results are tracked independently without overwriting each other?

Accepted Answer

Set a distinct `category` value for each analysis when uploading SARIF, so GitHub tracks each configuration's results separately.

Answer

Configure both workflows to run on the same trigger so their SARIF uploads are merged into a single result set.

Answer

Add a `ref` parameter override to the nightly workflow so it uploads results to a different branch.

Answer

Disable the pull request workflow and rely solely on the nightly extended scan to avoid duplicate alerts.

Question 2

You are configuring the default CodeQL workflow for a repository that receives frequent pull requests to the `main` branch. The security team wants alerts raised as early as possible on incoming changes, but they are also concerned about newly disclosed CodeQL query updates surfacing vulnerabilities in code that hasn't changed in weeks. The repository has a limited GitHub Actions minutes budget, so running a full analysis on every push to every feature branch is undesirable. Which combination of triggers in the CodeQL workflow best satisfies these requirements?

Accepted Answer

Trigger on `pull_request` targeting `main` plus a `schedule` (cron) that runs periodic full scans.

Answer

Trigger only on `push` to every branch so all commits are scanned immediately.

Answer

Trigger only on `workflow_dispatch` so the team runs scans manually when they judge it necessary.

Answer

Trigger on `push` to `main` only, with no scheduled runs, to conserve Actions minutes.

Question 3

A security engineer is triaging CodeQL code scanning alerts in a repository. One alert flags a SQL injection risk, but after review the engineer confirms the flagged input is fully sanitized by an internal wrapper that CodeQL's model does not recognize, so the alert does not represent a real vulnerability. The engineer wants to dismiss the alert in a way that accurately reflects this determination and helps improve future triage reporting. Which dismissal reason should be selected?

Accepted Answer

Dismiss as "False positive" because the flagged code path is not actually exploitable

Answer

Dismiss as "Won't fix" because the team has accepted the risk of leaving it in place

Answer

Dismiss as "Used in tests" because the code is not part of the production runtime

Answer

Delete the alert entirely so it no longer appears in the security overview metrics

Question 4

A developer opens a pull request that introduces a SQL injection vulnerability. CodeQL code scanning flags the alert on the PR and displays a suggested code change generated by CodeQL autofix. The developer wants to apply the fix as efficiently and safely as possible. What is the recommended way to handle the autofix suggestion?

Accepted Answer

Review the suggested fix for correctness, commit it to the PR branch (editing if needed), and let code scanning re-run to confirm the alert is resolved

Answer

Dismiss the alert as 'Used in tests' since autofix suggestions are automatically validated by CodeQL before being shown

Answer

Merge the PR immediately because the presence of an autofix suggestion means the vulnerability is already remediated in the analyzed code

Answer

Disable CodeQL autofix at the repository level, then manually rewrite the query so the alert no longer triggers

Question 5

A team maintains a large Java service and wants to add CodeQL analysis via GitHub Actions advanced setup. Their build system uses a proprietary Gradle plugin that frequently fails in the default autobuild step, causing the CodeQL database creation to error out before analysis. They want CodeQL to analyze the Java code without executing their build. Which configuration change should they make in the CodeQL workflow?

Accepted Answer

Set the `build-mode` to `none` for the Java language in the `github/codeql-action/init` step so CodeQL builds the database without invoking the project build

Answer

Remove the `autobuild` step and rely on CodeQL's automatic language detection to skip compilation for all languages

Answer

Switch the query suite to `security-extended`, which disables build requirements for compiled languages

Answer

Add `paths-ignore` for the Gradle build files so CodeQL does not attempt to compile them

Question 6

Your security team maintains a shared CodeQL query pack published to GitHub Packages that contains organization-specific security queries. You are using advanced setup and want the code scanning workflow for a JavaScript repository to run the built-in security-and-quality suite PLUS your custom query pack, while excluding one noisy built-in query by its query ID. Which approach correctly accomplishes all three requirements?

Accepted Answer

Create a CodeQL configuration file referenced via the `config-file` input, specifying `queries` for the security-and-quality suite, `packs` for the published custom query pack, and a `query-filters` section to exclude the noisy query by ID

Answer

Set the `queries` input on the `github/codeql-action/init` step to `security-and-quality` and add a second workflow that runs only the custom pack, then merge the SARIF files manually

Answer

Switch to default setup and enable the security-and-quality query suite in the repository settings, since default setup automatically discovers and runs any published organization query packs

Answer

Add the custom pack path to the `paths` input and list the excluded query under `paths-ignore`, while setting `queries: security-and-quality` on the analyze step

Question 7

A security engineer is reviewing a CodeQL alert flagged as 'SQL query built from user-controlled sources'. The alert view shows a series of connected steps from an HTTP request parameter through several variable assignments and finally into a database execution call. A developer argues the alert is a false positive because the input is validated. Which aspect of the CodeQL alert should the engineer examine to determine whether the reported vulnerability path is actually exploitable?

Accepted Answer

The dataflow path trace, verifying whether any step between the source and sink applies effective sanitization that CodeQL did not recognize as a barrier

Answer

The CVSS base score attached to the alert, which determines whether the flow reaches the sink

Answer

The Dependabot advisory linked to the alert, since it confirms the transitive dependency introducing the flaw

Answer

The commit timeline in the alert's history, which shows whether the source and sink were introduced in the same pull request

Question 8

A security engineer enabled CodeQL default setup on a repository to get scanning running quickly. Later, the team needs to add a custom CodeQL query pack maintained by their organization and adjust which build steps run before analysis. The engineer opens the repository's code scanning configuration but cannot find a way to specify custom queries or build commands. What is the correct action to enable these customizations?

Accepted Answer

Switch from default setup to advanced setup, which generates an editable codeql.yml workflow file where custom query packs and build steps can be defined

Answer

Edit the default setup configuration in the repository Security settings to paste the custom query pack reference into a queries field

Answer

Upload the custom query results as a SARIF file using the code scanning API, since default setup cannot run any CodeQL analysis

Answer

Disable code scanning entirely and re-enable default setup with the extended query suite, which automatically includes organization query packs

Question 9

Your organization runs CodeQL analysis on a self-hosted Jenkins pipeline instead of GitHub Actions because your build toolchain is highly customized. After the CodeQL CLI produces a `results.sarif` file, the team needs those results to appear as code scanning alerts in the repository's Security tab on GitHub.com. Which approach correctly delivers the SARIF results into GitHub code scanning?

Accepted Answer

Upload the SARIF file using the CodeQL CLI's `github upload-results` command (or the code scanning SARIF upload API endpoint) with a token that has the `security_events` write scope.

Answer

Commit the `results.sarif` file to the repository's default branch so GitHub automatically parses it into alerts.

Answer

Open a support ticket with GitHub to manually import the SARIF file, since external CI results cannot be ingested programmatically.

Answer

Convert the SARIF file to the Dependabot alert format and submit it via the Dependency Submission API.

Question 10

A DevOps engineer maintains a monorepo containing services written in Go, JavaScript, and Java. They want to enable CodeQL code scanning via GitHub Actions so that each language is analyzed independently and failures in one language's analysis do not block the others. Which approach best achieves this within a single workflow file?

Accepted Answer

Define a matrix strategy with fail-fast: false and a 'language' variable listing go, javascript, and java, so a separate job runs the init/analyze steps per language

Answer

Create one job that passes all three languages as a comma-separated string to the 'languages' input of the github/codeql-action/init step

Answer

Set the workflow to run on a nightly schedule only, since CodeQL cannot analyze more than one compiled language per push event

Answer

Add three separate workflow files, one per language, because a single workflow cannot invoke the CodeQL action more than once

Question 11

A security engineer wants their CodeQL code scanning workflow to run additional queries beyond the defaults, including lower-severity and lower-precision rules, to surface more potential issues during an internal audit. They are editing the CodeQL Action step in the workflow. Which configuration should they use to accomplish this?

Accepted Answer

Set the `queries` input to `security-extended` in the `github/codeql-action/init` step

Answer

Set `category: audit` on the `github/codeql-action/analyze` step

Answer

Add `paths-ignore` entries so more files are included in analysis

Answer

Change the workflow `on:` trigger to include a nightly `schedule` block

Question 12

Your security team ingests SARIF files produced by an external SAST tool into GitHub code scanning using the SARIF upload API. Some large SARIF uploads are being rejected or silently truncated, and developers complain that certain alerts never appear in the Security tab. Which characteristic of GitHub's SARIF ingestion should the team account for to ensure their results are reliably processed?

Accepted Answer

GitHub enforces limits on the SARIF file (such as maximum size and a cap on the number of results and runs per file), so uploads exceeding these thresholds are rejected or have results dropped.

Answer

SARIF files are only accepted if they were generated by CodeQL; third-party SARIF must first be converted to the CodeQL database format before upload.

Answer

GitHub only processes the first SARIF file uploaded per repository per day, so additional uploads within 24 hours are ignored entirely.

Answer

SARIF uploads require the file to be committed into the repository's default branch before the API will index any of its results.

Question 13

You maintain a large Java monorepo where the default CodeQL analysis workflow runs on GitHub-hosted runners. Recently the 'Perform CodeQL Analysis' step began failing intermittently with the runner terminating during the database build, and the logs show the process was killed after consuming all available memory. The team must keep using GitHub Actions for scanning. What is the most appropriate first step to resolve the failures while preserving analysis quality?

Accepted Answer

Switch the workflow to a larger GitHub-hosted or self-hosted runner with more memory to accommodate the CodeQL database build

Answer

Reduce the query suite to 'code-scanning' minimal queries so the analysis consumes less memory during the build phase

Answer

Disable the autobuild step and skip database creation, relying on SARIF upload from a prior successful run

Answer

Lower the scan frequency by triggering the workflow only on a monthly schedule to avoid resource contention

Question 14

A platform team maintains a large repository with services written in Go, TypeScript, and a legacy COBOL component. They currently use CodeQL for the Go and TypeScript code but need static analysis for COBOL, which CodeQL does not support. Leadership wants all findings consolidated in the repository's Security tab alongside the existing CodeQL alerts. What is the most appropriate approach?

Accepted Answer

Run a third-party COBOL analyzer in CI, have it emit SARIF, and upload that SARIF to GitHub using the code scanning upload action or API so results appear in the Security tab.

Answer

Wait for CodeQL to add COBOL support and disable code scanning for the other languages until then to avoid inconsistent tooling.

Answer

Add COBOL to the CodeQL matrix build language list so the CodeQL engine analyzes it alongside Go and TypeScript.

Answer

Configure the third-party analyzer to post COBOL findings only as pull request comments, since only CodeQL results can appear in the Security tab.

Question 15

A platform team notices their CodeQL analysis workflow is frequently triggered multiple times in quick succession when developers push several commits to the same feature branch within minutes. This causes a backlog of queued CodeQL jobs, consuming Actions runner minutes and delaying results for the latest commit. The team wants to ensure that when a newer run starts for a branch, any in-progress or queued CodeQL runs for that same branch are automatically cancelled. Which change to the CodeQL workflow best achieves this?

Accepted Answer

Add a `concurrency` group keyed to the workflow and branch ref with `cancel-in-progress: true` at the workflow level.

Answer

Change the workflow trigger to `schedule` with a cron expression so only one scan runs per interval.

Answer

Set `strategy.max-parallel: 1` in the matrix so only one CodeQL job runs at a time.

Answer

Enable default setup instead of advanced setup so GitHub automatically deduplicates scan runs.

Question 16

Your team enabled CodeQL code scanning default setup for a repository, but you notice the code scanning results only include JavaScript alerts even though the repository also contains a substantial Python backend and some C# tooling scripts. You want CodeQL to analyze the Python code as well without abandoning the maintainability of default setup. What is the correct approach?

Accepted Answer

Edit the repository's code scanning default setup configuration and explicitly add Python to the list of languages to be scanned.

Answer

Switch to advanced setup because default setup can only ever analyze a single language per repository.

Answer

Add a `paths` filter to the default setup so CodeQL is forced to include the Python source directories in its scan.

Answer

Create a separate repository for the Python code, since CodeQL default setup cannot combine multiple languages in one repository.

Question 17

A platform team runs CodeQL with advanced setup on a large JavaScript repository. Their scan produces dozens of alerts in a checked-in `vendor/` directory and in minified `dist/` bundles that they never author or fix directly. These noisy alerts are cluttering the Security tab and slowing analysis. The team wants CodeQL to stop analyzing those directories entirely while continuing to scan the application source. What is the most appropriate way to achieve this?

Accepted Answer

Add a `paths-ignore` configuration under the CodeQL analysis config (via the `config-file` or inline `config` in the init step) listing `vendor/` and `dist/`

Answer

Dismiss each alert in the `vendor/` and `dist/` directories individually as 'won't fix' so they no longer appear

Answer

Add `paths-ignore` to the `on.push` trigger of the workflow to exclude those directories

Answer

Add the directories to a `.gitignore` file so CodeQL skips them during checkout

Question 18

A DevOps engineer maintains a CodeQL advanced-setup workflow for a large repository. Currently the workflow triggers only on a weekly schedule, and developers complain that vulnerabilities introduced in feature branches are not surfaced until long after merge. The team wants CodeQL to analyze code as it is proposed, blocking regressions before they reach the default branch, while keeping scheduled scans for baseline coverage. Which change to the workflow's trigger configuration best meets this goal?

Accepted Answer

Add a `pull_request` trigger targeting the default branch (in addition to the existing `schedule` trigger) so CodeQL analyzes proposed changes and results appear as PR check runs.

Answer

Replace the `schedule` trigger with a `workflow_dispatch` trigger so developers can manually run CodeQL on their branches before opening a pull request.

Answer

Add a `push` trigger for all branches and remove the `schedule` trigger, since push events already cover every commit developers make.

Answer

Configure a `repository_dispatch` trigger tied to an external CI webhook so the CI system decides when CodeQL should run.

Question 19

Your team runs a proprietary static analysis tool in an external Jenkins pipeline, not on GitHub Actions. You want the tool's findings to appear as code scanning alerts in the GitHub Security tab of your repository, tracked alongside CodeQL results. The tool can export its findings to a standardized file format. What is the correct approach to get these findings into GitHub code scanning?

Accepted Answer

Have the tool produce a SARIF file and upload it to GitHub using the code scanning SARIF upload API (or the upload-sarif action), so the results appear as code scanning alerts.

Answer

Convert the tool's output to a Dependabot-compatible manifest and submit it through the Dependency Submission API.

Answer

Configure the tool to write JSON output to the repository, and GitHub will automatically detect and import it during the next push.

Answer

Third-party tools running outside GitHub Actions cannot post to code scanning; you must migrate the analysis to a GitHub Actions workflow using CodeQL.

More GH-500 practice