GH-500 · Domain 4: Configure and use Code Security (formerly Code Scanning with CodeQL) · 13% of the exam
Task 4.2: Set up and configure Code Security
Default and advanced setup, running CodeQL in GitHub Actions or an external CI system, matrix builds and how often to scan.
Study it
Default and advanced setup, external CI, matrix builds and scan frequency
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the GitHub documentation page that proves it.
Question 1 · choose 1
A rarely changed library repository has had default setup enabled for two years. Nobody has pushed or opened a pull request for seven months, and its code scanning results are now months old, although new CodeQL queries keep being released. How can its scans continue without editing the repository?
ASwitch the repository to advanced setup with a weekly cron schedule in a new workflow file
BEnable "Keep scheduled scans running every 30 days for inactive repositories" for the organization
CRe-enable default setup each quarter so that a new initial scan runs
DSet the default setup query suite to Extended, which also reschedules inactive repositories
Show the answer and why
ASwitch the repository to advanced setup with a weekly cron schedule in a new workflow file
Incorrect
That works but means maintaining a workflow, which the goal excludes.
BEnable "Keep scheduled scans running every 30 days for inactive repositories" for the organization
Correct
The global setting keeps default setup scanning inactive repositories monthly.
CRe-enable default setup each quarter so that a new initial scan runs
Incorrect
That changes the repository's settings by hand every quarter, and initial scans don't restart the weekly schedule.
DSet the default setup query suite to Extended, which also reschedules inactive repositories
Incorrect
The query suite doesn't change scheduling.
Default setup scans on pushes and pull requests to the default and protected branches, and weekly if a push or pull request triggered a scan in the last 180 days. Initial scans and configuration changes don't count. An organization owner can select "Keep scheduled scans running every 30 days for inactive repositories" in the Advanced Security global settings; the period isn't configurable.
Default setup for a Go service fails because the build needs a code-generation step and a private module proxy configured by a script. The team must keep scanning the Go code that is actually built. What should they do?
AKeep default setup and switch Go to the none build mode in its settings
BKeep default setup and add the build script's path to the github-codeql-extra-queries property
CUse advanced setup with build-mode: manual and the team's own build steps
DDrop Go from the analysis and rely on AI Scan for the Go code from now on
Show the answer and why
AKeep default setup and switch Go to the none build mode in its settings
Incorrect
Default setup uses autobuild for Go, and none isn't supported for Go.
BKeep default setup and add the build script's path to the github-codeql-extra-queries property
Incorrect
That property doesn't change how the code is built.
CUse advanced setup with build-mode: manual and the team's own build steps
Correct
Manual build mode runs the exact build commands CodeQL needs to observe.
DDrop Go from the analysis and rely on AI Scan for the Go code from now on
Incorrect
AI Scan targets languages CodeQL doesn't cover, and Go is covered.
Default setup uses the none build mode for C/C++, C#, Java and Rust, and autobuild for the other compiled languages, including Go. When autobuild can't build the code, advanced setup with build-mode: manual lets you specify the build steps CodeQL should observe.
The CodeQL CLI uses database create to build a CodeQL database, database analyze to run queries and write SARIF, and github upload-results to upload the SARIF to GitHub, where it becomes code scanning alerts.
When does the suggested CodeQL analysis workflow scan code?
AOnly once a month
BOn pushes to protected branches and pull requests to the default branch
COnly on pushes to feature branches
DOnly when a developer starts it manually from the Actions tab
Show the answer and why
AOnly once a month
Incorrect
It scans on events such as pushes and pull requests.
BOn pushes to protected branches and pull requests to the default branch
Correct
These are the suggested triggers.
COnly on pushes to feature branches
Incorrect
That isn't the default trigger set.
DOnly when a developer starts it manually from the Actions tab
Incorrect
It runs on events automatically.
In the suggested CodeQL analysis workflow, code scanning analyzes code each time you push to the default branch or any protected branch, or raise a pull request against the default branch.