GitHub Advanced Security Quiz 2

GitHub has many features that help you improve and maintain the quality of your code. Some of these are included in all plans, such as dependency graph and Dependabot alerts. This is a practice quiz for GHAS certification.

Total questions: 30
Time: 50 minutes
Passing score: 70%

Disclaimer: These are practice questions, not dumps.

START QUIZ

#1. Which API endpoint can be used to retrieve a list of all dependabot alerts for an enterprise?

GET /repos/{owner}/{repo}/dependabot/alerts

GET /github/{enterprise}/dependabot/alerts

GET /enterprises/{enterprise}/dependabot/alerts

GET /orgs/{org}/dependabot/alerts

#2. Which API endpoint can be used to retrieve a list of all secret scanning alerts for an organization?

GET /orgs/{org}/secret-scanning/alerts

GET /enterprises/{enterprise}/secret-scanning/alerts

GET /repos/{owner}/{repo}/secret-scanning/alerts

GET /github/{org}/secret-scanning/alerts

#3. Which API endpoint can be used to retrieve a list of all code scanning alerts for a repository?

GET /orgs/{org}/{repo}/code-scanning/alerts

GET /{enterprise}/{org}/{repo}/code-scanning/alerts

GET /github/{repo}/code-scanning/alerts

GET /repos/{owner}/{repo}/code-scanning/alerts

#4. Which of these statements best defines a vulnerable dependency?

A vulnerable dependency is dependency that a project relies on, which is not widely used or popular.

A vulnerable dependency is dependency that a project relies on, which contains security flaws that could potentially be exploited, compromising the project's security.

A vulnerable dependency is dependency that a project relies on, which has not been updated in a long time.

A vulnerable dependency is dependency that a project relies on, which is not verified by GitHub.

#5. What CodeQL CLI command is used to create a CodeQL database?

qlcli database create

ql database generate

codeql database create

gh codeql-database create

#6. What is the purpose of the `codeql database analyze` command in CodeQL CLI?

Analyzing a CodeQL database, producing results usually in the form of security advisories.

Analyzing a CodeQL database, producing results usually in the form of a SARIF file.

Analyzing the source code, producing a CodeQL database.

Analyzing a CodeQL database and uploading the results to GitHub.

#7. As part of your Jenkins CI pipeline, you've successfully created and then analyzed a CodeQL database, therefore producing a SARIF file. How can you upload the SARIF file to GitHub? (Choose two)

Select all that apply:

Using the github/codeql-action/upload-sarif GitHub Action

Using the codeql github upload-results command from CodeQL CLI

Using the GitHub REST API POST /repos/{owner}/{repo}/code-scanning/sarifs endpoint

By committing the SARIF file to the GitHub repository

Using the gh codeql upload-results command from GitHub CLI

#8. What details can you find on a code scanning alert page? (Choose three)

Select all that apply:

ID of the CodeQL database that was used to find the vulnerability

Information how many times the vulnerability has been exploited

Highlighted vulnerable code

Branches affected by the vulnerability

Assigned developer to fix the vulnerability

Severity of the vulnerability

#9. Which of these statements regarding viewing the results of a CodeQL analysis are true? (Choose two)

Select all that apply:

Anyone with read permission for a repository can see code scanning annotations on pull requests.

You need write permission to view code scanning annotations on pull requests.

Anyone with read permissions for a repository can view code scanning alerts in the Security tab.

You need write permission to view a summary of all the alerts for a repository in the Security tab.

Only the repository owner can see the code scanning alerts in the Security tab.

#10. When a CodeQL analysis GitHub Actions workflow detects a new vulnerability on a pull request, where can you find the information about that vulnerability?

In the security tab of the repository

In the workflow run logs

The CodeQL analysis workflow will fail and produce an artifact with the results

Directly in the pull request in the form of a PR comment and a check failure

#11. When viewing a code scanning alert what is the `Show paths` option used for?

It will show recommendations on how to fix the vulnerability

It's used for showing the paths to the CodeQL queries that were used to find the vulnerability

It's used for showing the file path to the CodeQL database that was used to find the vulnerability

It will display the path through the code that leads to the issue causing the alert.

#12. What does it mean to dismiss a code scanning alert?

Closing an alert that you don't think needs to be fixed

Closing the alert after fixing the vulnerability in the code

#13. Which of these is NOT a valid approach one can take to reduce the time it takes for CodeQL analysis workflow to complete?

Reduce the number of queries that are run

Ignore irrelevant files and directories from the analysis

Run the analysis on every push event

Use runners with more CPU/RAM resources

Parallelize the analysis for multi-language codebases

#14. What is the purpose of defining a SARIF category?

Use the category to distinguish files that have been analyzed from files that have not been analyzed.

Use a different category for each file that has been analyzed to easily track back the vulnerabilities to the files that contain them.

Use the category to distinguish files that contain vulnerabilities from files that do not contain vulnerabilities.

Use the category to distinguish between multiple analyses for the same tool or commit, but performed on different languages or different parts of the code.

#15. Which of these statements are true regarding running CodeQL analysis on codebases with multiple programming languages? (Choose two)

Select all that apply:

CodeQL uses a different extractor for each programming language

CodeQL database schema is the same for each programming language

CodeQL creates separate databases for each programming language

CodeQL creates one database for all programming languages in the codebase, as long as they are supported by CodeQL

#16. What are the differences when running CodeQL database creation for compiled and interpreted languages? (Choose two)

Select all that apply:

For compiled languages, the extractor runs on the executable file.

For interpreted languages, the extractor runs directly on the source code.

For interpreted languages, extraction works by monitoring the build process. All information is collected each time the interpreter is invoked to process a source file.

For compiled languages, the extractor runs directly on the source code.

For compiled languages, extraction works by monitoring the build process. All information is collected each time the compiler is invoked to process a source file.

For interpreted languages, the extractor runs on the executable file.

#17. Where can you see when the last CodeQL analysis was run when using the default code scanning setup?

You can't see that information with the default setup

In the code scanning tool status page

In the Dependabot tab

In repository insights

#18. Which of the following statements about enabling CodeQL scanning default setup are true? (Choose two)

Select all that apply:

GitHub Actions need to be enabled as a prerequisite

Default setup will scan the repository on a schedule that you can configure. For event-based scanning, you need to configure a GitHub Action workflow

You can enable default setup for all eligible repositories in an organization at once in the organization settings

You can only use the default query suite with default CodeQL scanning setup

You can enable default setup on any repository, regardless of the contents of the repository

#19. How can you customize your advanced CodeQL scanning setup with additional CodeQL query suites? (Choose two)

Select all that apply:

By defining the customizations in the Security / Code scanning repository settings

By using the github/codeql-customizations GitHub Action

By defining the customizations in the CodeQL analysis GitHub Actions workflow as input parameters to the github/codeql-action/init action

By using the CodeQL CLI with a custom configuration file to run the analysis

By using a custom configuration file and defining additional queries there

#20. When running CodeQL analysis in GitHub Actions, what Actions should you use? (Choose three)

Select all that apply:

github/codeql-action/autobuild

github/codeql-action/analyze

github/codeql-action/init

github/codeql-action/autobuild only for compiled programming languages

github/codeql-action/init only for compiled programming languages

github/codeql-action/analyze only for interpreted programming languages

#21. What is the simplest method to execute CodeQL analysis concurrently for each language in a multi-language repository using GitHub Actions?

By calling the github/codeql-action/analyze action in separate steps for each language

Define the parallelism in the github/codeql-action/analyze action

By creating a separate workflow for each language

By creating a languages matrix for the job and then reference it in the github/codeql-action/init action's languages input parameter

#22. How can you use a custom CodeQL configuration file in a GitHub Actions workflow?

By storing the configuration in .github/workflows/codeql-analysis.yml file. The github/codeql-action/init action will automatically detect the file and use it

By uploading that file in the Code Scanning section of the Security tab in the repository

By storing the configuration in .github/codeql/config-config.yml file. The github/codeql-action/init action will automatically detect the file and use it

By explicitly providing the configuration file path in the config-file input parameter of the github/codeql-action/init action

#23. Where can you specify the CodeQL queries to run in a GitHub Actions workflow? (Choose two)

Select all that apply:

In the Code Scanning section of the Security tab in the repository

In a CodeQL configuration YAML file

In the paths input parameter of the github/codeql-action/queries action

In the codeql field of the .github/settings.yml file

In the queries input parameter of the github/codeql-action/init action

#24. What is the purpose of the `external-repository-token` parameter in `github/codeql-action/init` GitHub Action?

It allows the action to access a private GitHub repository that contains the source code to be analyzed.

It allows the action to access a private GitHub repository that contains configuration files, queries or packs that are required for the analysis.

It allows the action to upload the results of the analysis to a private GitHub repository.

It allows the action to upload the generated CodeQL database to a private GitHub repository.

#25. What is extraction in the context of CodeQL code analysis?

Extraction is the process of exporting data from a CodeQL database.

Extraction is the process of creating CodeQL queries specific to the codebase.

Extraction is the action of running CodeQL queries against a CodeQL database and extracting the results.

Extraction is the process of creating a relational representation of each source file in the codebase.

#26. What are the steps of CodeQL analysis workflow?

Creating a CodeQL database -> Running CodeQL queries -> Interpreting the results

Creating a CodeQL database -> Interpreting the results -> Running CodeQL queries

Running CodeQL queries -> Interpreting the results

Running CodeQL queries -> Creating a CodeQL database -> Interpreting the results

#27. What is a CodeQL query pack?

It's a library used by CodeQL queries

It's a set of results that were generated in the process of analyzing a CodeQL database

It's a collection of CodeQL queries

It's a set of pre-compiled queries with all transitive dependencies such as libraries and models

#28. What are the different types of CodeQL packs? (Choose three)

Select all that apply:

Query packs

Code packs

Vulnerability packs

Language packs

Library packs

Model packs

#29. What is a CodeQL query suite?

CodeQL suite is a collection of CodeQL databases

CodeQL suite is a collection of CodeQL results

CodeQL suite is a collections of CodeQL queries

CodeQL suite is a collection of CodeQL supported languages

#30. What is QL?

QL is a npm package that is used by CodeQL to scan code

QL is a query language that underlies CodeQL

QL is a similar product to CodeQL but is used for scanning text files instead of code

QL stands for Quality Level and is a metric used by CodeQL

Finish

Results

pass

Post Views: 15

fail

Post Views: 15

Post Views: 15

#1. Which API endpoint can be used to retrieve a list of all dependabot alerts for an enterprise?

#2. Which API endpoint can be used to retrieve a list of all secret scanning alerts for an organization?

#3. Which API endpoint can be used to retrieve a list of all code scanning alerts for a repository?

#4. Which of these statements best defines a vulnerable dependency?

#5. What CodeQL CLI command is used to create a CodeQL database?

#6. What is the purpose of the `codeql database analyze` command in CodeQL CLI?

#7. As part of your Jenkins CI pipeline, you've successfully created and then analyzed a CodeQL database, therefore producing a SARIF file. How can you upload the SARIF file to GitHub? (Choose two)

#8. What details can you find on a code scanning alert page? (Choose three)

#9. Which of these statements regarding viewing the results of a CodeQL analysis are true? (Choose two)

#10. When a CodeQL analysis GitHub Actions workflow detects a new vulnerability on a pull request, where can you find the information about that vulnerability?

#11. When viewing a code scanning alert what is the `Show paths` option used for?

#12. What does it mean to dismiss a code scanning alert?

#13. Which of these is NOT a valid approach one can take to reduce the time it takes for CodeQL analysis workflow to complete?

#14. What is the purpose of defining a SARIF category?

#15. Which of these statements are true regarding running CodeQL analysis on codebases with multiple programming languages? (Choose two)

#16. What are the differences when running CodeQL database creation for compiled and interpreted languages? (Choose two)

#17. Where can you see when the last CodeQL analysis was run when using the default code scanning setup?

#18. Which of the following statements about enabling CodeQL scanning default setup are true? (Choose two)

#19. How can you customize your advanced CodeQL scanning setup with additional CodeQL query suites? (Choose two)

#20. When running CodeQL analysis in GitHub Actions, what Actions should you use? (Choose three)

#21. What is the simplest method to execute CodeQL analysis concurrently for each language in a multi-language repository using GitHub Actions?

#22. How can you use a custom CodeQL configuration file in a GitHub Actions workflow?

#23. Where can you specify the CodeQL queries to run in a GitHub Actions workflow? (Choose two)

#24. What is the purpose of the `external-repository-token` parameter in `github/codeql-action/init` GitHub Action?

#25. What is extraction in the context of CodeQL code analysis?

#26. What are the steps of CodeQL analysis workflow?

#27. What is a CodeQL query pack?

#28. What are the different types of CodeQL packs? (Choose three)

#29. What is a CodeQL query suite?

#30. What is QL?

Results

Leave a Reply Cancel reply