GitHub Advanced Security Quiz 3

GitHub has many features that help you improve and maintain the quality of your code. Some of these are included in all plans, such as dependency graph and Dependabot alerts. This is a practice quiz for GHAS certification.

Total questions: 30
Time: 50 minutes
Passing score: 70%

Disclaimer: These are practice questions, not dumps.

START QUIZ

#1. When using CodeQL analysis in your GitHub Actions workflow, how often is the scan triggered?

Code scanning is triggered on a configurable schedule.

Code scanning can be triggered on a configurable schedule or on pull requests.

Code scanning is triggered on every push to the repository.

Code scanning can be triggered for many different events that happen in the repository.

#2. What is the effect of adding the `paths-ignore` keyword to your code scanning GitHub Actions workflow?

Preventing the CodeQL analysis from running on pull requests that change files with the specified extensions.

It tells CodeQL to omit all *.txt and *.md files from the analysis.

Pull request checks will ignore any CodeQL vulnerabilities that are found in *.txt and *.md files.

Avoiding unnecessary scans when files that are not relevant to the analysis are changed.

#3. CodeQL scanning supports?

Only compiled languages

All programming languages

Only interpreted languages

Both compiled and interpreted languages

#4. What are CodeQL queries used for?

CodeQL queries can be run against a CodeQL database to identify patterns that may indicate coding errors or security vulnerabilities.

CodeQL queries are text-based questions you can ask the CodeQL engine about your codebase.

CodeQL queries are used for code review purposes in GitHub.

CodeQL queries analyze your codebase and are used to create a CodeQL database.

#5. Fill in the blank: `GitHub __________ is a feature that you can use to analyze code in a GitHub repository to find security vulnerabilities and coding errors.`

Vulnerability Detection

Code Scanning

Dependency Graph

Security Advisories

#6. Which GitHub Advanced Security feature allows you to find, triage, and prioritize fixes for new and existing problems in your code?

Dependabot alerts

Code scanning

Security policies

Security advisories

#7. How can you enable code scanning for a repository?

Go to your user settings and enable code scanning, you can choose to enable it for all or only selected repositories.

Go to the security tab of the repository settings and enable code scanning with default or advanced setup.

Go to the security tab of the repository settings and answer a questionnaire about the repository contents. Based on the answers, GitHub will enable code scanning with the appropriate configuration.

Add a .github/codeql.ymlconfiguration file to the repository.

#8. How can you configure your GitHub repository to run CodeQL analysis on a schedule? (Choose two)

Select all that apply:

By adding a schedule property to the .github/codeql.yml configuration file.

By raising a request with GitHub support to enable scheduled CodeQL analysis for the repository.

By creating a GitHub Actions workflow with a schedule trigger. The workflow should leverage actions from the github/codeql-action repository.

By using the default CodeQL analysis setup.

By setting the codeql.trigger property in the repository settings to schedule.

#9. An organization has recently started using CodeQL analysis for all pull requests on their repositories as well as running the analysis on an hourly schedule. Since then they are experiencing larger than usual GitHub Actions bills. What is the most likely cause of this?

The code scanning analysis is finding more issues than expected and is taking longer to complete.

There is no correlation between code scanning and GitHub Actions billing. The organization is being billed for other GitHub Actions workflows.

Code scanning can only be run on a daily schedule and the organization is being billed for the additional usage.

Code scanning uses GitHub Actions and the organization is being billed for the additional usage.

#10. If you don't want to use GitHub Actions, you can run code scanning in an external CI system, then upload the results to GitHub.

True

False

#11. When using a third party CI system to run code scanning, what GitHub tool do you need to analyze the codebase?

You don't specifically need a GitHub tool, any static analysis tool that can produce results in SARIF format will work.

You need to install GitHub CLI

You need to install CodeQL CLI

You need to install the GitHub Code Scanning tool.

#12. When using GitHub Actions as your CI system and a third-party tool to run code scanning, how can you upload the SARIF results to GitHub?

You can only use CodeQL when running code scanning in GitHub Actions. Third party code scanning tools are not supported.

By using the github/codeql-action/upload-sarif GitHub Action.

By using the actions/upload-artifact GitHub Action.

When using GitHub Actions the SARIF results are automatically uploaded to GitHub.

#13. Can you use CodeQL analysis with third party CI systems?

No, because it requires using the github/codeql-action GitHub Action.

Yes, you just need to use the CodeQL CLI.

#14. Which of these is true about code scanning? (Choose two)

Select all that apply:

Code scanning helps find insecure code patterns which can be missed by manual code review.

Code scanning helps find any leaked credentials in the codebase such as API keys or cloud credentials.

Code scanning is a replacement for manual code review.

Code scanning can be integrated into the CI pipeline to find security issues early in the development process.

Code scanning scans your code to search for all dependencies and their versions to find any vulnerable dependencies.

#15. How can CodeQL be used in an external CI system together with GitHub repositories?

Upload source code to GitHub for analysis and then download results for use in the CI system.

Run CodeQL CLI in the external CI system to scan code and upload the results to the GitHub repository.

Manually run CodeQL locally and email the results to the GitHub repository administrators.

CodeQL cannot be used in external CI systems; it is exclusive to GitHub Actions.

#16. Which of these statements isn't true about secret scanning on GitHub?

Secret scanning will scan your entire Git history on all branches present in your GitHub repository for secrets.

Secret scanning is a tool for secure secret storage and management.

Secret scanning can prevent supported secrets from being pushed into your enterprise, organization, or repository.

Secret scanning will scan titles, descriptions, and comments, in open and closed historical issues for secrets.

#17. Which top-level keys are required in the `dependabot.yml` file?

version and package-ecosystem

assignees and directory

version and updates

updates and directory

#18. Which GitHub Action can be used to upload a third-party SARIF file?

github/codeql-action/upload-sarif

actions/upload-sarif

codeql-upload-sarif

github/codeql-action

#19. Which tool can be used in a third-party CI system to upload code analysis results to GitHub?

GitHub Actions github/codeql-action

CodeQL CLI

GitHub CLI

CodeQL API

#20. What is required for a CI server to upload SARIF results to GitHub?

Administrator access to the GitHub repository.

A special plugin installed in the CI system.

A direct connection to the GitHub Advisory Database.

A GitHub App or personal access token with security_events write permission.

#21. What happens when a second SARIF results file is uploaded to GitHub for a single commit?

It is ignored by GitHub.

It replaces the original set of data.

It appends the results to the existing file.

It creates a new branch in the repository.

#22. How can users exclude specific directories from secret scanning alerts on GitHub?

By editing the repository's README.md file.

Through the repository's Settings tab, in the Code security and analysis menu.

Through the repository's Security tab, in the Secret scanning menu.

By configuring a secret_scanning.yml file, under the .github path in the repository.

#23. Which key should be used in a `secret_scanning.yml` file to exclude directories from secret scanning alerts in GitHub?

exclude-paths:

ignore-directories

paths-exclude:

paths-ignore:

#24. What is the maximum number of custom patterns that can be defined for secret scanning on GitHub?

There's no limit to the number of custom patterns you can define for secret scanning in GitHub.

100 for organizations, enterprises and repositories.

500 for organizations/enterprises and 100 for repositories.

100 for organizations/enterprises and 500 for repositories.

#25. What is the purpose of code scanning in GitHub?

To synchronize code with production servers

To check code formatting and style

To review pull requests automatically

To identify vulnerabilities and errors in code

#26. Is secret scanning available for both public and private repositories on GitHub?

No, it is only available for public repositories

Yes, with no additional requirements

No, it is only available for private repositories

Yes, but for private repositories, it requires a license for GitHub Advanced Security

#27. What does the default CodeQL analysis setup in GitHub do?

Automatically chooses languages to analyze, query suite to run, and events that trigger scans

Manually requires users to specify languages and queries for each scan

Requires separate installation of third-party scanning tools

Scans code only on a monthly basis

#28. What is the main purpose of using the CodeQL CLI?

To automatically merge pull requests

To schedule regular maintenance tasks in a repository

To generate a database representation of a codebase, a CodeQL database

To manage repository settings and permissions

#29. Which of the following languages is NOT supported by CodeQL for code scanning?

PHP

Python

C/C++

JavaScript/TypeScript

#30. How does CodeQL analyze code in GitHub?

It uses machine learning to predict potential vulnerabilities based on past commits.

It relies solely on third-party tools for code analysis.

It generates a CodeQL database and runs queries to identify problems, displaying results as code scanning alerts.

It performs manual code reviews submitted by GitHub community members.

Finish

Results

pass

Post Views: 7

fail

Post Views: 7

Post Views: 7

#1. When using CodeQL analysis in your GitHub Actions workflow, how often is the scan triggered?

#2. What is the effect of adding the `paths-ignore` keyword to your code scanning GitHub Actions workflow?

#3. CodeQL scanning supports?

#4. What are CodeQL queries used for?

#5. Fill in the blank: `GitHub __________ is a feature that you can use to analyze code in a GitHub repository to find security vulnerabilities and coding errors.`

#6. Which GitHub Advanced Security feature allows you to find, triage, and prioritize fixes for new and existing problems in your code?

#7. How can you enable code scanning for a repository?

#8. How can you configure your GitHub repository to run CodeQL analysis on a schedule? (Choose two)

#9. An organization has recently started using CodeQL analysis for all pull requests on their repositories as well as running the analysis on an hourly schedule. Since then they are experiencing larger than usual GitHub Actions bills. What is the most likely cause of this?

#10. If you don't want to use GitHub Actions, you can run code scanning in an external CI system, then upload the results to GitHub.

#11. When using a third party CI system to run code scanning, what GitHub tool do you need to analyze the codebase?

#12. When using GitHub Actions as your CI system and a third-party tool to run code scanning, how can you upload the SARIF results to GitHub?

#13. Can you use CodeQL analysis with third party CI systems?

#14. Which of these is true about code scanning? (Choose two)

#15. How can CodeQL be used in an external CI system together with GitHub repositories?

#16. Which of these statements isn't true about secret scanning on GitHub?

#17. Which top-level keys are required in the `dependabot.yml` file?

#18. Which GitHub Action can be used to upload a third-party SARIF file?

#19. Which tool can be used in a third-party CI system to upload code analysis results to GitHub?

#20. What is required for a CI server to upload SARIF results to GitHub?

#21. What happens when a second SARIF results file is uploaded to GitHub for a single commit?

#22. How can users exclude specific directories from secret scanning alerts on GitHub?

#23. Which key should be used in a `secret_scanning.yml` file to exclude directories from secret scanning alerts in GitHub?

#24. What is the maximum number of custom patterns that can be defined for secret scanning on GitHub?

#25. What is the purpose of code scanning in GitHub?

#26. Is secret scanning available for both public and private repositories on GitHub?

#27. What does the default CodeQL analysis setup in GitHub do?

#28. What is the main purpose of using the CodeQL CLI?

#29. Which of the following languages is NOT supported by CodeQL for code scanning?

#30. How does CodeQL analyze code in GitHub?

Results

Leave a Reply Cancel reply