GH-500 · Domain 4: Configure and use Code Security (formerly Code Scanning with CodeQL) · 13% of the exam
Task 4.1: Understand code scanning approaches and tooling
CodeQL, AI Scan and third-party analyzers, when each fits, and how SARIF files bring outside results into code scanning.
Study it
CodeQL, AI Scan, third-party tools and SARIF
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the GitHub documentation page that proves it.
Question 1 · choose 1
A company's main repository is a PHP application with Terraform for its infrastructure, and it already has GitHub Code Security and default setup enabled. The security lead wants security findings on pull requests for this code without adding another scanning tool or any build configuration. What should be enabled?
AAI Scan for pull requests
BA CodeQL model pack that describes the PHP framework used by the application
CThe php language in the default setup configuration of CodeQL for the repository
DThe security-extended query suite in default setup, which adds more languages to the analysis
Show the answer and why
AAI Scan for pull requests
Correct
AI Scan finds vulnerabilities on pull requests in languages and frameworks CodeQL doesn't cover.
BA CodeQL model pack that describes the PHP framework used by the application
Incorrect
Model packs extend CodeQL to more libraries in supported languages, not to new languages.
CThe php language in the default setup configuration of CodeQL for the repository
Incorrect
CodeQL doesn't support PHP, so there is no such language to select.
DThe security-extended query suite in default setup, which adds more languages to the analysis
Incorrect
Query suites change which queries run, not which languages are analyzed.
CodeQL supports C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust, Swift and GitHub Actions workflows, not PHP or Terraform. AI Scan for pull requests runs an AI-based engine on pull requests that touch languages and frameworks CodeQL doesn't cover, such as PHP, shell, Terraform and Dockerfiles, with no separate tool or build. Its findings are advisory.
Where can a security engineer read the source of the default CodeQL queries and contribute improvements to them?
AIn the GitHub Advisory Database, next to each advisory
BNowhere, because the queries ship closed source inside the CLI
CIn the github/codeql repository
DIn the GitHub Marketplace listing for CodeQL
Show the answer and why
AIn the GitHub Advisory Database, next to each advisory
Incorrect
The Advisory Database holds advisories, not queries.
BNowhere, because the queries ship closed source inside the CLI
Incorrect
The default queries are open source.
CIn the github/codeql repository
Correct
The queries are open source, and you can view and contribute to them in github/codeql.
DIn the GitHub Marketplace listing for CodeQL
Incorrect
The queries live in a public repository, not in a Marketplace listing.
GitHub experts, security researchers and community contributors write and maintain the default CodeQL queries used for code scanning. The queries are open source, so you can view and contribute to them in the github/codeql repository.
BAs backlog alerts in the repository's code scanning list
CIn the Dependabot alerts list
DOnly in the audit log
Show the answer and why
AOn pull requests, alongside CodeQL alerts
Correct
AI Scan findings are only available on pull requests.
BAs backlog alerts in the repository's code scanning list
Incorrect
They don't appear as backlog alerts.
CIn the Dependabot alerts list
Incorrect
They are code findings.
DOnly in the audit log
Incorrect
They are shown on the pull request.
AI Scan runs on pull requests, and its findings, labeled AI, appear on the Conversation and Files changed tabs alongside CodeQL alerts. Unlike CodeQL alerts, they don't appear as backlog alerts in the repository's security view.
A team plans to run the CodeQL CLI in its existing CI system instead of GitHub Actions. All of its build agents use musl-based Alpine Linux images. What should it know before choosing this approach?
AThe CodeQL CLI runs only inside GitHub Actions
BThe CodeQL CLI needs a GitHub Enterprise Server instance to upload its results
CThe CodeQL CLI analyzes only interpreted languages such as Python
DThe CLI doesn't run on non-glibc Linux such as Alpine
Show the answer and why
AThe CodeQL CLI runs only inside GitHub Actions
Incorrect
The CLI is a standalone tool that runs in third-party CI systems.
BThe CodeQL CLI needs a GitHub Enterprise Server instance to upload its results
Incorrect
The CLI uploads results to GitHub.com as well.
CThe CodeQL CLI analyzes only interpreted languages such as Python
Incorrect
It analyzes compiled languages too, such as Java, C# and Go.
DThe CLI doesn't run on non-glibc Linux such as Alpine
Correct
The CodeQL CLI is currently not compatible with non-glibc distributions such as musl-based Alpine Linux.
The CodeQL CLI is a standalone tool that you can run in a third-party CI system to analyze dynamic and compiled languages and upload the results to GitHub as code scanning alerts. It is currently not compatible with non-glibc Linux distributions such as musl-based Alpine Linux, so the build agents need a supported image.