GH-500 · Domain 5: Security operations: best practices, prioritization, and remediation · 18% of the exam
Task 5.3: Customize and optimize security detection
Choosing CodeQL query suites, packs and threat models, and fitting detection to how risky each part of the organization is.
Study it
Query suites, packs and threat models fitted to organizational risk
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the GitHub documentation page that proves it.
Question 1 · choose 1
A repository's advanced setup workflow analyzes Java and Python in a language matrix and reads one shared CodeQL configuration file. The security team has published a query pack with Java-only queries for an internal framework and wants it to run only in the Java analysis, while Python keeps its current queries. What should the team change?
AAdd the pack to the packs input of the init step in the workflow
BSwitch both languages to the security-extended suite
CUse a nested packs map in the configuration file, listing the pack under java
DList the pack in a flat packs array in the configuration file
Show the answer and why
AAdd the pack to the packs input of the init step in the workflow
Incorrect
The init step is shared by both matrix jobs, and for workflows that create databases for several languages the packs belong in a configuration file.
BSwitch both languages to the security-extended suite
Incorrect
A built-in suite doesn't include the team's own pack, and it would also change the Python analysis.
CUse a nested packs map in the configuration file, listing the pack under java
Correct
A nested map assigns packs per language when a workflow creates more than one CodeQL database.
DList the pack in a flat packs array in the configuration file
Incorrect
A flat array isn't tied to a language, so it doesn't keep the pack out of the Python analysis.
For workflows that generate CodeQL databases for more than one language, query packs are specified in a custom configuration file rather than in the workflow's packs input. A nested map of packs keyed by language, for example a java entry, runs each pack only in the analysis for that language.
A team using default setup wants CodeQL to also report maintainability and reliability problems, on top of all the security-extended queries. Which change gives them that query suite?
ASelect security-and-quality in the default setup configuration dialog
BAsk an owner to recommend the Extended suite for the organization
CMove the repository to advanced setup and set queries: security-and-quality
DSet github-codeql-disable-overlay to true
Show the answer and why
ASelect security-and-quality in the default setup configuration dialog
Incorrect
The default setup configuration dialog lists only the Default and Extended suites.
BAsk an owner to recommend the Extended suite for the organization
Incorrect
Extended doesn't add maintainability or reliability queries.
CMove the repository to advanced setup and set queries: security-and-quality
Correct
Advanced setup can name the suite in the workflow's queries input.
DSet github-codeql-disable-overlay to true
Incorrect
That property doesn't select query suites.
The built-in suites are default, security-extended (called Extended) and security-and-quality (security-extended plus maintainability and reliability queries). The default setup configuration dialog offers Default and Extended only; in advanced setup the workflow can set queries: security-and-quality.
How does the security-extended suite relate to the default suite?
AIt adds lower-precision queries to the default ones
BIt contains fewer queries than the default suite does
CIt contains only quality queries
DIt is unrelated to default
Show the answer and why
AIt adds lower-precision queries to the default ones
Correct
security-extended is a superset of default.
BIt contains fewer queries than the default suite does
Incorrect
It contains more.
CIt contains only quality queries
Incorrect
That describes part of security-and-quality.
DIt is unrelated to default
Incorrect
It builds on default.
The security-extended suite consists of all queries in the default suite plus additional queries with slightly lower precision and severity, so it may return more false positives.
How can an organization encourage repositories that enable default setup to use the Extended suite?
ABy editing each repository's workflow
BBy recommending it in the global settings
CBy adding security-extended to each repository's dependabot.yml
DBy creating a custom pattern
Show the answer and why
ABy editing each repository's workflow
Incorrect
Default setup has no workflow file.
BBy recommending it in the global settings
Correct
The global setting suggests Extended for default setup.
CBy adding security-extended to each repository's dependabot.yml
Incorrect
That file isn't for CodeQL.
DBy creating a custom pattern
Incorrect
Patterns are for secret scanning.
In the Advanced Security global settings, select "Recommend the extended query suite for repositories enabling default setup" to suggest Extended across the organization.
A custom CodeQL query should show the data-flow path from source to sink in its alerts. Which @kind should it declare?
Aproblem
Bpath-problem
Cmetric
Ddiagnostic
Show the answer and why
Aproblem
Incorrect
problem reports a simple alert.
Bpath-problem
Correct
path-problem reports an alert with a code location sequence.
Cmetric
Incorrect
metric reports a summary metric.
Ddiagnostic
Incorrect
diagnostic is for extractor troubleshooting.
Custom queries declare metadata such as @id and @kind. @kind problem reports a simple alert, path-problem an alert with a sequence of code locations, diagnostic extractor troubleshooting, and metric a summary metric.
Which file type defines a custom CodeQL query suite?
A.ql
B.sarif
C.qhelp
D.qls
Show the answer and why
A.ql
Incorrect
.ql files hold queries.
B.sarif
Incorrect
SARIF holds results.
C.qhelp
Incorrect
.qhelp holds query help.
D.qls
Correct
Query suites are YAML files with the .qls extension.
Query suite definitions are stored in YAML files with the .qls extension. Each instruction selects queries, and the result is the set of selected queries. Custom suites are used with advanced setup.