GH-500 Practice Questions

A.  

Dependencies parsed from a repository's manifest and lock files.

B.  

Annotated code scanning alerts from your repository's dependencies.

C.  

A summary of the dependencies used in your organization's repositories.

D.  

Dependencies from all your repositories.

A.  

Dependency graph

B.  

Dependency review

C.  

Dependabot alert

D.  

The repository's Security tab

A.  

Remove specific build steps.

B.  

Compile the source code.

C.  

Remove the autobuild step from your code scanning workflow and add specific build steps.

D.  

Use CodeQL, which implicitly detects the supported languages in your code base.

A.  

query

B.  

qlpack

C.  

qls

A.  

In a third-party Git repository

B.  

In a workflow

C.  

In an external continuous integration (CI) system

D.  

In the Files changed tab of the pull request

A.  

Creates a pull request to upgrade the vulnerable dependency to the minimum possible secure version

B.  

Scans repositories for vulnerable dependencies on a schedule and adds those files to a manifest

C.  

Constructs a graph of all the repository's dependencies and public dependents for the default branch

D.  

Scans any push to all branches and generates an alert for each vulnerable repository

A.  

Create a CODEOWNERS file

B.  

Make the repository public

C.  

Configure a security manager

D.  

Enable push protection

A.  

Push protection must be enabled for all, or none, of a repository's custom patterns.

B.  

Push protection is an opt-in experience for each custom pattern.

C.  

Push protection is not available for custom patterns.

D.  

Push protection is enabled by default for new custom patterns.​

A.  

Search for potential security vulnerabilities, detect secrets, and show the full impact of changes to dependencies

B.  

Confidentially report security vulnerabilities and privately discuss and fix security vulnerabilities in your repository's code

C.  

View alerts about dependencies that are known to contain security vulnerabilities

D.  

Automatically raise pull requests, which reduces your exposure to older versions of dependencies

A.  

Upload compiled binaries.

B.  

Use CodeQL's init action.

C.  

Ignore paths.

D.  

Implement custom build steps.

E.  

Use jobs.analyze.runs-on.

F.  

Use CodeQL's autobuild action.