GitHub Advanced Security Quiz 2

GitHub has many features that help you improve and maintain the quality of your code. Some of these are included in all plans, such as dependency graph and Dependabot alerts. This is a practice quiz for GHAS certification.

Total questions: 30
Time: 50 minutes
Passing score: 70%

Disclaimer: These are practice questions, not dumps.

START QUIZ

#1. Which API endpoint can be used to retrieve a list of all dependabot alerts for an enterprise?

GET /github/{enterprise}/dependabot/alerts

GET /enterprises/{enterprise}/dependabot/alerts

GET /orgs/{org}/dependabot/alerts

GET /repos/{owner}/{repo}/dependabot/alerts

#2. Which API endpoint can be used to retrieve a list of all secret scanning alerts for an organization?

GET /github/{org}/secret-scanning/alerts

GET /repos/{owner}/{repo}/secret-scanning/alerts

GET /enterprises/{enterprise}/secret-scanning/alerts

GET /orgs/{org}/secret-scanning/alerts

#3. Which API endpoint can be used to retrieve a list of all code scanning alerts for a repository?

GET /github/{repo}/code-scanning/alerts

GET /{enterprise}/{org}/{repo}/code-scanning/alerts

GET /repos/{owner}/{repo}/code-scanning/alerts

GET /orgs/{org}/{repo}/code-scanning/alerts

#4. Which of these statements best defines a vulnerable dependency?

A vulnerable dependency is dependency that a project relies on, which contains security flaws that could potentially be exploited, compromising the project's security.

A vulnerable dependency is dependency that a project relies on, which has not been updated in a long time.

A vulnerable dependency is dependency that a project relies on, which is not verified by GitHub.

A vulnerable dependency is dependency that a project relies on, which is not widely used or popular.

#5. What CodeQL CLI command is used to create a CodeQL database?

codeql database create

gh codeql-database create

qlcli database create

ql database generate

#6. What is the purpose of the `codeql database analyze` command in CodeQL CLI?

Analyzing a CodeQL database, producing results usually in the form of a SARIF file.

Analyzing a CodeQL database, producing results usually in the form of security advisories.

Analyzing the source code, producing a CodeQL database.

Analyzing a CodeQL database and uploading the results to GitHub.

#7. As part of your Jenkins CI pipeline, you've successfully created and then analyzed a CodeQL database, therefore producing a SARIF file. How can you upload the SARIF file to GitHub? (Choose two)

Select all that apply:

Using the codeql github upload-results command from CodeQL CLI

Using the GitHub REST API POST /repos/{owner}/{repo}/code-scanning/sarifs endpoint

By committing the SARIF file to the GitHub repository

Using the gh codeql upload-results command from GitHub CLI

Using the github/codeql-action/upload-sarif GitHub Action

#8. What details can you find on a code scanning alert page? (Choose three)

Select all that apply:

Assigned developer to fix the vulnerability

Branches affected by the vulnerability

ID of the CodeQL database that was used to find the vulnerability

Highlighted vulnerable code

Information how many times the vulnerability has been exploited

Severity of the vulnerability

#9. Which of these statements regarding viewing the results of a CodeQL analysis are true? (Choose two)

Select all that apply:

Only the repository owner can see the code scanning alerts in the Security tab.

You need write permission to view a summary of all the alerts for a repository in the Security tab.

You need write permission to view code scanning annotations on pull requests.

Anyone with read permission for a repository can see code scanning annotations on pull requests.

Anyone with read permissions for a repository can view code scanning alerts in the Security tab.

#10. When a CodeQL analysis GitHub Actions workflow detects a new vulnerability on a pull request, where can you find the information about that vulnerability?

In the workflow run logs

In the security tab of the repository

The CodeQL analysis workflow will fail and produce an artifact with the results

Directly in the pull request in the form of a PR comment and a check failure

#11. When viewing a code scanning alert what is the `Show paths` option used for?

It will show recommendations on how to fix the vulnerability

It will display the path through the code that leads to the issue causing the alert.

It's used for showing the file path to the CodeQL database that was used to find the vulnerability

It's used for showing the paths to the CodeQL queries that were used to find the vulnerability

#12. What does it mean to dismiss a code scanning alert?

Closing the alert after fixing the vulnerability in the code

Closing an alert that you don't think needs to be fixed

#13. Which of these is NOT a valid approach one can take to reduce the time it takes for CodeQL analysis workflow to complete?

Reduce the number of queries that are run

Use runners with more CPU/RAM resources

Run the analysis on every push event

Ignore irrelevant files and directories from the analysis

Parallelize the analysis for multi-language codebases

#14. What is the purpose of defining a SARIF category?

Use the category to distinguish between multiple analyses for the same tool or commit, but performed on different languages or different parts of the code.

Use the category to distinguish files that contain vulnerabilities from files that do not contain vulnerabilities.

Use a different category for each file that has been analyzed to easily track back the vulnerabilities to the files that contain them.

Use the category to distinguish files that have been analyzed from files that have not been analyzed.

#15. Which of these statements are true regarding running CodeQL analysis on codebases with multiple programming languages? (Choose two)

Select all that apply:

CodeQL database schema is the same for each programming language

CodeQL creates one database for all programming languages in the codebase, as long as they are supported by CodeQL

CodeQL uses a different extractor for each programming language

CodeQL creates separate databases for each programming language

#16. What are the differences when running CodeQL database creation for compiled and interpreted languages? (Choose two)

Select all that apply:

For compiled languages, the extractor runs directly on the source code.

For interpreted languages, the extractor runs directly on the source code.

For interpreted languages, extraction works by monitoring the build process. All information is collected each time the interpreter is invoked to process a source file.

For interpreted languages, the extractor runs on the executable file.

For compiled languages, extraction works by monitoring the build process. All information is collected each time the compiler is invoked to process a source file.

For compiled languages, the extractor runs on the executable file.

#17. Where can you see when the last CodeQL analysis was run when using the default code scanning setup?

In repository insights

In the Dependabot tab

In the code scanning tool status page

You can't see that information with the default setup

#18. Which of the following statements about enabling CodeQL scanning default setup are true? (Choose two)

Select all that apply:

You can enable default setup on any repository, regardless of the contents of the repository

Default setup will scan the repository on a schedule that you can configure. For event-based scanning, you need to configure a GitHub Action workflow

You can only use the default query suite with default CodeQL scanning setup

You can enable default setup for all eligible repositories in an organization at once in the organization settings

GitHub Actions need to be enabled as a prerequisite

#19. How can you customize your advanced CodeQL scanning setup with additional CodeQL query suites? (Choose two)

Select all that apply:

By using a custom configuration file and defining additional queries there

By defining the customizations in the Security / Code scanning repository settings

By defining the customizations in the CodeQL analysis GitHub Actions workflow as input parameters to the github/codeql-action/init action

By using the CodeQL CLI with a custom configuration file to run the analysis

By using the github/codeql-customizations GitHub Action

#20. When running CodeQL analysis in GitHub Actions, what Actions should you use? (Choose three)

Select all that apply:

github/codeql-action/autobuild

github/codeql-action/init

github/codeql-action/init only for compiled programming languages

github/codeql-action/analyze

github/codeql-action/autobuild only for compiled programming languages

github/codeql-action/analyze only for interpreted programming languages

#21. What is the simplest method to execute CodeQL analysis concurrently for each language in a multi-language repository using GitHub Actions?

By creating a languages matrix for the job and then reference it in the github/codeql-action/init action's languages input parameter

By calling the github/codeql-action/analyze action in separate steps for each language

By creating a separate workflow for each language

Define the parallelism in the github/codeql-action/analyze action

#22. How can you use a custom CodeQL configuration file in a GitHub Actions workflow?

By storing the configuration in .github/codeql/config-config.yml file. The github/codeql-action/init action will automatically detect the file and use it

By explicitly providing the configuration file path in the config-file input parameter of the github/codeql-action/init action

By uploading that file in the Code Scanning section of the Security tab in the repository

By storing the configuration in .github/workflows/codeql-analysis.yml file. The github/codeql-action/init action will automatically detect the file and use it

#23. Where can you specify the CodeQL queries to run in a GitHub Actions workflow? (Choose two)

Select all that apply:

In the codeql field of the .github/settings.yml file

In the queries input parameter of the github/codeql-action/init action

In the Code Scanning section of the Security tab in the repository

In a CodeQL configuration YAML file

In the paths input parameter of the github/codeql-action/queries action

#24. What is the purpose of the `external-repository-token` parameter in `github/codeql-action/init` GitHub Action?

It allows the action to upload the generated CodeQL database to a private GitHub repository.

It allows the action to upload the results of the analysis to a private GitHub repository.

It allows the action to access a private GitHub repository that contains the source code to be analyzed.

It allows the action to access a private GitHub repository that contains configuration files, queries or packs that are required for the analysis.

#25. What is extraction in the context of CodeQL code analysis?

Extraction is the process of exporting data from a CodeQL database.

Extraction is the process of creating CodeQL queries specific to the codebase.

Extraction is the action of running CodeQL queries against a CodeQL database and extracting the results.

Extraction is the process of creating a relational representation of each source file in the codebase.

#26. What are the steps of CodeQL analysis workflow?

Creating a CodeQL database -> Interpreting the results -> Running CodeQL queries

Running CodeQL queries -> Creating a CodeQL database -> Interpreting the results

Running CodeQL queries -> Interpreting the results

Creating a CodeQL database -> Running CodeQL queries -> Interpreting the results

#27. What is a CodeQL query pack?

It's a set of results that were generated in the process of analyzing a CodeQL database

It's a collection of CodeQL queries

It's a library used by CodeQL queries

It's a set of pre-compiled queries with all transitive dependencies such as libraries and models

#28. What are the different types of CodeQL packs? (Choose three)

Select all that apply:

Library packs

Code packs

Model packs

Language packs

Vulnerability packs

Query packs

#29. What is a CodeQL query suite?

CodeQL suite is a collection of CodeQL results

CodeQL suite is a collection of CodeQL supported languages

CodeQL suite is a collections of CodeQL queries

CodeQL suite is a collection of CodeQL databases

#30. What is QL?

QL stands for Quality Level and is a metric used by CodeQL

QL is a query language that underlies CodeQL

QL is a npm package that is used by CodeQL to scan code

QL is a similar product to CodeQL but is used for scanning text files instead of code

Finish

Results

pass

Post Views: 4

fail

Post Views: 4

Post Views: 4

#1. Which API endpoint can be used to retrieve a list of all dependabot alerts for an enterprise?

#2. Which API endpoint can be used to retrieve a list of all secret scanning alerts for an organization?

#3. Which API endpoint can be used to retrieve a list of all code scanning alerts for a repository?

#4. Which of these statements best defines a vulnerable dependency?

#5. What CodeQL CLI command is used to create a CodeQL database?

#6. What is the purpose of the `codeql database analyze` command in CodeQL CLI?

#7. As part of your Jenkins CI pipeline, you've successfully created and then analyzed a CodeQL database, therefore producing a SARIF file. How can you upload the SARIF file to GitHub? (Choose two)

#8. What details can you find on a code scanning alert page? (Choose three)

#9. Which of these statements regarding viewing the results of a CodeQL analysis are true? (Choose two)

#10. When a CodeQL analysis GitHub Actions workflow detects a new vulnerability on a pull request, where can you find the information about that vulnerability?

#11. When viewing a code scanning alert what is the `Show paths` option used for?

#12. What does it mean to dismiss a code scanning alert?

#13. Which of these is NOT a valid approach one can take to reduce the time it takes for CodeQL analysis workflow to complete?

#14. What is the purpose of defining a SARIF category?

#15. Which of these statements are true regarding running CodeQL analysis on codebases with multiple programming languages? (Choose two)

#16. What are the differences when running CodeQL database creation for compiled and interpreted languages? (Choose two)

#17. Where can you see when the last CodeQL analysis was run when using the default code scanning setup?

#18. Which of the following statements about enabling CodeQL scanning default setup are true? (Choose two)

#19. How can you customize your advanced CodeQL scanning setup with additional CodeQL query suites? (Choose two)

#20. When running CodeQL analysis in GitHub Actions, what Actions should you use? (Choose three)

#21. What is the simplest method to execute CodeQL analysis concurrently for each language in a multi-language repository using GitHub Actions?

#22. How can you use a custom CodeQL configuration file in a GitHub Actions workflow?

#23. Where can you specify the CodeQL queries to run in a GitHub Actions workflow? (Choose two)

#24. What is the purpose of the `external-repository-token` parameter in `github/codeql-action/init` GitHub Action?

#25. What is extraction in the context of CodeQL code analysis?

#26. What are the steps of CodeQL analysis workflow?

#27. What is a CodeQL query pack?

#28. What are the different types of CodeQL packs? (Choose three)

#29. What is a CodeQL query suite?

#30. What is QL?

Results

Leave a Reply Cancel reply