GH-500 · Domain 6: GitHub Security suites administration · 13% of the exam
Task 6.4: Manage CodeQL and security automation
Enabling default or approved custom CodeQL workflows across many repositories, and the REST APIs, webhooks and audit log that automate security configuration and governance.
Study it
CodeQL workflows at scale, and APIs, webhooks and the audit log for automation
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the GitHub documentation page that proves it.
Question 1 · choose 2
A platform team automates onboarding: every repository its provisioning tool creates must get a specific security configuration, and the same configuration should be the organization's default. Which two operations does the REST API for code security configurations provide for this? (Choose TWO.)
AOverride enforcement so that the tool can change features on enforced repositories
BCreate custom secret scanning patterns
CApprove push protection bypass requests for new repositories
DAttach a configuration to repositories
ESet a configuration as the default for new repositories
Show the answer and why
AOverride enforcement so that the tool can change features on enforced repositories
Incorrect
Enforcement can't be overridden through the API.
BCreate custom secret scanning patterns
Incorrect
Custom patterns have their own endpoints.
CApprove push protection bypass requests for new repositories
Incorrect
Bypass requests have their own review process.
DAttach a configuration to repositories
Correct
The API can attach configurations to repositories.
ESet a configuration as the default for new repositories
Correct
The API can set a configuration as a default.
The REST API for code security configurations can list, create, update and delete configurations, attach them to repositories, detach them, and set a configuration as a default.
An organization sets an organization-wide default value for the github-codeql-config-file property, pointing to codeql.yml in its private security-config repository. Default setup repositories elsewhere in the organization can't read the file, and the repository must stay private. What fixes this while limiting the credential's reach?
AMake the security-config repository public
BPass external-repository-token in the CodeQL workflow of each repository that needs the file
CA Git Source private registry configuration for that repository's URL
DAdd the file to every repository and drop the property
Show the answer and why
AMake the security-config repository public
Incorrect
That exposes the configuration rather than granting access.
BPass external-repository-token in the CodeQL workflow of each repository that needs the file
Incorrect
Default setup has no workflow to edit; that input is for advanced setup.
CA Git Source private registry configuration for that repository's URL
Correct
Default setup needs that configuration to read files from other private repositories.
DAdd the file to every repository and drop the property
Incorrect
That abandons central maintenance.
The recommended way to customize default setup at scale is an organization-wide default for the github-codeql-config-file property. To use a file in an internal or private repository other than the one analyzed, set up a Git Source private registry configuration, ideally with the full repository URL so credentials are used only for that repository. Advanced setup instead passes a token in external-repository-token.
How can a script manage security configurations without the web UI?
AWith a secret_scanning.yml file in each repository
BWith dependabot.yml
CWith a CodeQL configuration file in each repository
DWith the code security configurations REST API
Show the answer and why
AWith a secret_scanning.yml file in each repository
Incorrect
That file configures secret scanning, not security configurations.
BWith dependabot.yml
Incorrect
That configures Dependabot.
CWith a CodeQL configuration file in each repository
Incorrect
That file tunes CodeQL analysis, not security configurations.
DWith the code security configurations REST API
Correct
It covers organization and enterprise configurations.
The REST API endpoints for code security configurations let a script manage the security configurations of organizations and enterprises without the web UI.
An enterprise on GitHub Enterprise Cloud must keep a continuous copy of its audit log events, from every organization, in the company's Splunk instance. What should an enterprise owner set up?
AA scheduled CSV export from security overview
BA monthly manual export from the audit log page
CAudit log streaming to Splunk
DA repository webhook added to each repository
Show the answer and why
AA scheduled CSV export from security overview
Incorrect
Security overview exports alert and coverage data, not audit events.
BA monthly manual export from the audit log page
Incorrect
A manual export is a snapshot, not a continuous copy.
CAudit log streaming to Splunk
Correct
Streaming sends audit and Git events for all of the enterprise's organizations to an external system such as Splunk.
DA repository webhook added to each repository
Incorrect
Repository webhooks report repository events one repository at a time; they don't deliver the enterprise audit log.
Audit log streaming keeps copies of your audit log data in an external data management system such as Splunk, Datadog or cloud storage. The stream exports audit and Git events for all organizations in the enterprise from the time it is enabled, and a paused stream keeps a seven-day buffer.
A security manager's nightly script must collect the open code scanning alerts on the default branches of every repository in the organization. Which REST API endpoint fits best?
AList code scanning alerts for an organization
BGet a code scanning default setup configuration
CList code scanning analyses for a repository
DGet information about a SARIF upload
Show the answer and why
AList code scanning alerts for an organization
Correct
It lists default-branch alerts for all eligible repositories in the organization and can filter them by state.
BGet a code scanning default setup configuration
Incorrect
It returns one repository's default setup settings.
CList code scanning analyses for a repository
Incorrect
It lists analyses, not alerts, and one repository at a time.
DGet information about a SARIF upload
Incorrect
It reports the processing status of a single upload.
The organization endpoint for code scanning alerts lists alerts for the default branch of all eligible repositories in an organization, with filters such as state and tool; the caller must be an owner or security manager. The repository endpoints return one repository's analyses, default setup configuration or SARIF upload status.
How can a script check or change whether AI Scan is enabled for an organization or repository?
ABy editing the CodeQL workflow of every repository
BWith the code scanning REST API's ai-scan setting
CBy editing dependabot.yml
DBy uploading a SARIF file
Show the answer and why
ABy editing the CodeQL workflow of every repository
Incorrect
AI Scan isn't configured in a workflow.
BWith the code scanning REST API's ai-scan setting
Correct
The API manages the organization and repository ai-scan setting.
CBy editing dependabot.yml
Incorrect
That file is for Dependabot.
DBy uploading a SARIF file
Incorrect
SARIF carries results.
You can use the REST API for code scanning to manage the organization or repository ai-scan setting, for example to get the AI Scan setting for an organization.