Free GH-500 sample questions

Correct answer: The pull request is from a fork, and the workflow lacks the necessary `pull_request_target` trigger and permissions to analyze code from forks.

Workflows triggered by `pull_request` from forks run in a restricted context with a read-only token and no access to secrets. This can cause the `Initialize CodeQL` step to fail if it needs to access certain resources or if the analysis is complex. To analyze code from forks securely, the workflow should be changed to use the `pull_request_target` event, which runs in the context of the base repository but checks out the code from the pull request's HEAD commit. This is a common and critical distinction for securing workflows that run on code from external contributors.

Correct answer: False

Push protection applies to all users, regardless of their permissions. A user, including an administrator, must explicitly bypass the block by providing a reason. The protection is not automatically disabled for administrators; they are subject to the same initial block as any other contributor.

Correct answer: Create a repository ruleset targeting the `main` branch, add the CodeQL and Dependency Review jobs as required status checks, and do not select the option to allow admins to bypass.

While branch protection rules can require status checks, administrators can typically override them. Repository rulesets provide a more powerful and flexible way to enforce policies. By creating a ruleset that targets the `main` branch and requires the specific status checks, you can enforce the policy across the repository or organization. Crucially, rulesets have an explicit option to prevent even administrators from bypassing the rules, which meets the stated requirement.

Correct answer: Investigate the top-level dependency that is pulling in the vulnerable transitive dependency and check if updating the top-level dependency resolves the issue.

For transitive dependencies, a direct patch for the sub-dependency may not exist or be the correct solution. The proper approach is to identify which direct dependency in the manifest file (e.g., `package.json`) is responsible for including the vulnerable package. Often, updating this top-level dependency to a newer version will, in turn, pull in a non-vulnerable version of the transitive dependency. Dependabot alerts often provide this context.

Correct answer: In the CI pipeline, run the tool, convert its JSON output to the SARIF format, and then upload the SARIF file to the code scanning API endpoint.

GitHub's code scanning feature is designed to ingest security results using the industry-standard Static Analysis Results Interchange Format (SARIF). To integrate a third-party tool, the output must first be converted into a valid SARIF v2.1.0 file. This transformed file can then be uploaded to the `/code-scanning/sarifs` API endpoint or using the `github/codeql-action/upload-sarif` action in a workflow. Direct upload of custom JSON is not supported.

Correct answer: For C#, CodeQL must monitor the compilation process to build a relational database of the code, while for Python, it can extract the database directly from the source files.

The fundamental difference is that for compiled languages (C#, Java, C++, Go), CodeQL needs to observe the build process. It hooks into the compiler to understand how source files are related, how libraries are linked, and to build an accurate, queryable database representing the code's structure and data flow. For interpreted languages (Python, JavaScript, Ruby), there is no compilation step, so CodeQL can extract this information directly from the source code itself without needing to monitor a build.

Correct answer: An aggregated view of security alerts from code scanning, secret scanning, and Dependabot across all repositories.

The Security Overview is a centralized dashboard that aggregates security alerts from all enabled features (Code Scanning, Secret Scanning, Dependabot) across the repositories in an organization. It allows security managers and administrators to quickly identify repositories with the most critical alerts and track overall risk trends without needing to inspect each repository individually.

Correct answer: Secret scanning validity checks, which automatically query the service provider to determine if a discovered secret is active.

Secret scanning validity checks are designed for this exact scenario. When a secret from a supported partner is detected, GitHub can optionally send the token to the provider's endpoint to verify if it is still active. This information is then displayed on the alert, allowing teams to filter for and prioritize the remediation of secrets that pose an immediate, confirmed risk.

Correct answer: Dependency Review

Dependency Review is the feature specifically designed to analyze dependency changes within a pull request. It shows a diff of the dependencies, highlighting any new vulnerabilities being introduced, changes in licenses, and other critical information. This allows developers to assess the security impact before merging new code. Dependabot alerts, in contrast, scan the existing dependencies in a repository and raise alerts on the Security tab, but do not provide this proactive, in-PR diff view.

Correct answer: A step-by-step trace of how untrusted data flows from a source to a sink, leading to the vulnerability.

The 'Show paths' feature is a powerful data-flow analysis tool within CodeQL alerts. For vulnerabilities like SQL injection or cross-site scripting, it visually traces the journey of tainted data from its entry point (the 'source,' e.g., an HTTP request) through the application to the point where it's used unsafely (the 'sink,' e.g., a database query). This helps developers understand the root cause and fix it effectively.