GH-500 · Domain 4: Configure and use Code Security (formerly Code Scanning with CodeQL) · 13% of the exam
Task 4.4: Optimize and automate Code Security operations
Configuration files and repository properties that tune analysis, and diagnosing slow, failed or incomplete scans.
Study it
Tuning analysis and troubleshooting failed or slow scans
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the GitHub documentation page that proves it.
Question 1 · choose 1
An organization sets the github-codeql-config-file repository property to a shared configuration that adds path exclusions. Most repositories use default setup with threat models chosen in the UI; one repository uses advanced setup with its own config-file input in the workflow. Which configuration does each use?
ADefault setup repositories use only the shared file, which discards the threat models chosen in the UI
BThe advanced setup repository uses the shared file, which overrides its workflow input
CDefault setup merges the file with its UI settings, and the advanced workflow keeps its own file
DThe property applies only to advanced setup, so default setup repositories ignore the shared file
Show the answer and why
ADefault setup repositories use only the shared file, which discards the threat models chosen in the UI
Incorrect
The file is merged with the UI selections, which are kept.
BThe advanced setup repository uses the shared file, which overrides its workflow input
Incorrect
An explicit config-file input takes precedence over the property.
CDefault setup merges the file with its UI settings, and the advanced workflow keeps its own file
Correct
That is how the property combines with each setup type.
DThe property applies only to advanced setup, so default setup repositories ignore the shared file
Incorrect
The property applies to both setup types.
The github-codeql-config-file property points to a local or remote configuration file. For default setup it is merged with the automatically generated configuration, keeping UI choices such as threat models and model packs. It also applies to advanced setup, unless the workflow sets an explicit config-file input for codeql-action/init, which then takes precedence.
An advanced setup workflow for a Java project, with build-mode: manual, fails with "No source code was seen during the build". The job runs mvn package as its first step, then codeql-action/init, then codeql-action/analyze, and Maven reuses outputs from a build cache restored at the start. Which two changes address the cause? (Choose TWO.)
AMove the build so that it runs between the init and analyze steps
BMake sure a full compilation happens instead of a cached one
CAdd the java-kotlin language a second time in the init step
DRaise the runner's memory so that the extractor can finish
EReplace the analyze step with the upload-sarif action
Show the answer and why
AMove the build so that it runs between the init and analyze steps
Correct
CodeQL must observe the compiler, which happens only between init and analyze.
BMake sure a full compilation happens instead of a cached one
Correct
CodeQL needs a complete build to watch; cached components aren't seen.
CAdd the java-kotlin language a second time in the init step
Incorrect
Listing a language twice doesn't change what CodeQL observes.
DRaise the runner's memory so that the extractor can finish
Incorrect
Memory isn't the problem; the compiler ran when CodeQL wasn't watching.
EReplace the analyze step with the upload-sarif action
Incorrect
Without analysis there are no results to upload.
For compiled languages built with autobuild or manual mode, CodeQL monitors the compiler. If the code is compiled outside the init and analyze steps, if parts of the build are cached so no real compilation happens (common with Gradle or Bazel), or if it is built in another container, CodeQL sees no source code. The build must run between init and analyze, and fully.
How can a team download the CodeQL database built in an Actions workflow to inspect which files were extracted?
AAdd a SECURITY.md file
BEnable Copilot Autofix
CSet debug: true on codeql-action/init
DExport an SBOM
Show the answer and why
AAdd a SECURITY.md file
Incorrect
That is a security policy.
BEnable Copilot Autofix
Incorrect
Autofix suggests fixes.
CSet debug: true on codeql-action/init
Correct
The database is then uploaded as an Actions artifact.
DExport an SBOM
Incorrect
SBOMs list dependencies.
Setting debug: true on the init step of the CodeQL workflow uploads the database as an Actions artifact. It includes src.zip, a copy of the source files CodeQL scanned, which you can compare with the repository.
Which CodeQL configuration keyword excludes one noisy query from analysis?
Apaths-ignore
Bquery-filters
Cthreat-models
Dexclude-queries
Show the answer and why
Apaths-ignore
Incorrect
That excludes files, not queries.
Bquery-filters
Correct
query-filters excludes queries.
Cthreat-models
Incorrect
That changes sources of tainted data.
Dexclude-queries
Incorrect
The CodeQL configuration has no such keyword.
In advanced setup, the query-filters keyword in the CodeQL configuration excludes one or more queries from analysis, for example a single rule that dominates the results.
A repository with Java and Kotlin code uses default setup with build mode none. The CodeQL run warns that Kotlin files "could not be processed without a build". What explains the warning?
ACodeQL doesn't support Kotlin
BThe runner ran out of disk space during extraction
CThe Kotlin code needs a newer CodeQL version than default setup uses
DWithout a build, Kotlin files are left out of the CodeQL database
Show the answer and why
ACodeQL doesn't support Kotlin
Incorrect
Kotlin is supported; it is analyzed with Java as java-kotlin.
BThe runner ran out of disk space during extraction
Incorrect
A lack of disk space produces an "Out of disk" error, not this warning.
CThe Kotlin code needs a newer CodeQL version than default setup uses
Incorrect
Default setup always uses the latest version of the CodeQL action.
DWithout a build, Kotlin files are left out of the CodeQL database
Correct
Build mode none covers Java, but Kotlin files are excluded unless the code is built.
CodeQL can create a database for Java without building the code, but Kotlin files are excluded unless the code is built, so the warning appears when build mode none is used for a repository with both Java and Kotlin files. To include Kotlin, disable and re-enable default setup once the Kotlin code is on the default branch, so that it uses automatic build detection, or use advanced setup with autobuild or manual build steps.
Improved incremental analysis fails on a repository because of its higher hardware needs. Which change turns it off?
AThe github-codeql-disable-overlay property set to true
BThe security-extended suite instead of the default suite
CA lower memory limit for the runner
Dbuild-mode: none in the init step
Show the answer and why
AThe github-codeql-disable-overlay property set to true
Correct
Setting it to true disables improved incremental analysis.
BThe security-extended suite instead of the default suite
Incorrect
A larger suite adds work; it doesn't turn incremental analysis off.
CA lower memory limit for the runner
Incorrect
Less memory makes failures more likely.
Dbuild-mode: none in the init step
Incorrect
Build mode changes how the database is created, not incremental analysis.
You can disable improved incremental analysis by setting the github-codeql-disable-overlay repository property to true, which may help when that analysis fails because of increased hardware requirements.