GH-500 Sample Questions Answers

The GitHub Code Scanning API includes endpoints that allow you to:

List alerts for a repository (filtered by branch, state, or tool) — useful for monitoring security over time.

Get a single alert by its ID to inspect its metadata, status, and locations in the code.

However, GitHub does not support modifying the severity of alerts via API — severity is defined by the scanning tool (e.g., CodeQL). Likewise, alerts cannot be deleted via the API; they are resolved by fixing the code or dismissing them manually.

When a vulnerability is detected, GitHub shows a warning that includes a brief description of the vulnerability . This typically covers the name of the CVE (if available), a short summary of the issue, severity level, and potential impact. The message also links to additional advisory data from the GitHub Advisory Database.

This helps developers understand the context and urgency of the vulnerability before applying the fix.

Comprehensive and Detailed Explanation:

To generate a dependency graph for a private repository, GitHub requires:​

Dependency graph enabled: The repository must have the dependency graph feature enabled. This can be configured at the organization level to apply to all new private repositories.​

Access to manifest and lock files: GitHub needs read-only access to the repository's dependency manifest and lock files (e.g., package.json, requirements.txt) to identify and map dependencies.​

Comprehensive and Detailed Explanation:

When setting up CodeQL analysis for compiled languages, there are two primary methods to build your code:​

GitHub Docs

Autobuild: CodeQL attempts to automatically build your codebase using the most likely build method. This is suitable for standard build processes.​

GitHub Docs

Custom Build Steps: For complex or non-standard build processes, you can implement custom build steps by specifying explicit build commands in your workflow. This provides greater control over the build process.​

GitHub Docs

The init action initializes the CodeQL analysis but does not build the code. The jobs.analyze.runs-on specifies the operating system for the runner but is not directly related to building the code. Uploading compiled binaries is not a method supported by CodeQL for analysis.​

A custom CodeQL configuration file can be stored in an external repository and referenced by multiple repositories. This allows an organization to centralize query packs, additional queries, query filters, path exclusions, threat-model configuration, and other CodeQL settings rather than duplicating the same settings across many workflow files. GitHub explicitly documents centralized configuration as a benefit of external configuration files. A token may be required when an advanced-setup workflow retrieves a configuration file from a private external repository, but providing the token is not the purpose of the configuration file itself. Likewise, a configuration file does not automatically choose a package, and query packs do not inherently disable the default query suite. Default queries are disabled only when the appropriate configuration option is deliberately specified. Therefore, C is correct.

Ignoring an unresolved code scanning alert leaves the underlying security issue present in the application. GitHub identifies several risks through CodeQL data-flow analysis, including data being used insecurely, dangerous arguments reaching sensitive functions, and sensitive information being leaked. These are precisely the kinds of vulnerabilities for which code scanning traces data from a source to a potentially unsafe sink. GitHub does not automatically remove an unresolved alert merely because sixty days have elapsed. Likewise, webhooks and the code scanning API can expose alert events and enable integrations, but they do not automatically eliminate the vulnerability. Proper remediation requires fixing the affected code or intentionally dismissing an alert with an appropriate reason after security review. Therefore, A, B, and E describe the relevant security implications.

The config-file input is used with the github/codeql-action/init action to specify the path to a custom CodeQL configuration file. This configuration can define additional query packs, custom queries, directories to include or exclude, and other CodeQL analysis settings. GitHub's official workflow documentation shows config-file under the with: section of the CodeQL initialization step. The queries input is used to specify additional query suites or query packs directly, rather than referencing a configuration file. source-root and db-location are not the appropriate init inputs for supplying the configuration-file path. Therefore, when the CodeQL workflow must load settings from a separate YAML configuration file, config-file is the correct parameter.

When you identify that a code scanning alert is a false positive—such as when your code uses a custom sanitization method not recognized by the analysis—you should dismiss the alert with the reason "false positive." This action helps improve the accuracy of future analyses and maintains the relevance of your security alerts.​

As per GitHub's documentation:​

"If you dismiss a CodeQL alert as a false positive result, for example because the code uses a sanitization library that isn't supported, consider contributing to the CodeQL repository and improving the analysis."​

By dismissing the alert appropriately, you ensure that your codebase's security alerts remain actionable and relevant.

The command @dependabot ignore this dependency closes the current Dependabot pull request and creates an ignore condition that prevents Dependabot from opening additional pull requests for that dependency. The restriction remains until the pull request is reopened or the dependency is manually upgraded to the suggested version. @dependabot recreate performs the opposite action: it recreates the pull request and overwrites edits made to it. @dependabot rebase rebases the Dependabot pull request against the current target branch. GitHub does not document @dependabot close as the command for permanently suppressing the dependency update. GitHub also provides more granular commands to ignore only a major, minor, or patch version when permanent dependency-level suppression would be too broad.

Known vulnerable dependencies detected in a repository are presented as Dependabot alerts. GitHub uses the dependency graph to determine which packages and versions the repository depends on and compares that information with vulnerability data from the GitHub Advisory Database. When a match is found, an alert appears in the repository's Security and quality area under Dependabot vulnerabilities. Each alert can provide the affected dependency, vulnerability details, severity, the affected manifest or lockfile, and a secure version when one is available. Secret scanning alerts relate to exposed credentials, while code scanning alerts represent vulnerabilities or coding errors in source code. Security advisories are vulnerability records and disclosure mechanisms rather than the repository-specific list of vulnerable dependencies.

To proactively address secret scanning:

Webhooks can be configured to listen for secret scanning events. This allows automation, logging, or alerting in real-time when secrets are detected.

Documenting secure development practices (like using environment variables or secret managers) helps reduce the likelihood of developers committing secrets in the first place.

Dismissal based on age is not a best practice without triage. SCIM deals with user provisioning, not scanning alerts.

To ensure you're notified whenever a vulnerability is detected via Dependabot, you must enable alerts for Dependabot in your personal notification settings. This applies to both new and existing repositories. It ensures you get timely alerts about security vulnerabilities.

The dependency graph must be enabled for scanning, but does not send alerts itself.

Repository rulesets provide centralized enforcement of repository policies before changes can be merged. Rulesets can require workflows or status checks to succeed, and GitHub specifically supports security-oriented enforcement such as dependency review and code scanning merge protection. For dependency review, an organization can require the dependency review workflow through a ruleset so that vulnerable dependency changes prevent merging. Code scanning rulesets can likewise require acceptable code scanning results and define alert thresholds. “Security GuardRails” and “status enforcement” are not GitHub repository features with the functionality described here, while Insights is primarily used for repository statistics and reporting. Therefore, repository rulesets provide the policy mechanism needed to enforce these security gates before code reaches protected branches.

Dependabot security updates are automated pull requests triggered when GitHub detects a vulnerability in a dependency listed in your manifest or lockfile. These PRs upgrade the dependency to the minimum safe version that fixes the vulnerability.

This is separate from regular updates (which keep versions current even if not vulnerable).

Comprehensive and Detailed Explanation:

When GitHub identifies a vulnerable dependency in a repository with Dependabot alerts enabled, it performs the following actions:​

Generates a Dependabot alert: The alert is displayed on the repository's Security tab, providing details about the vulnerability and affected dependency.​

Notifies repository maintainers: By default, GitHub notifies users with write, maintain, or admin permissions about new Dependabot alerts.​

GitHub Docs

These actions ensure that responsible parties are informed promptly to address the vulnerability.​

GitHub code scanning integrates with third-party static analysis tools through SARIF, the Static Analysis Results Interchange Format. A compatible analysis tool generates its findings as a SARIF file, which GitHub can process and display as code scanning alerts within the repository. GitHub supports SARIF output generated outside GitHub, including results from external CI/CD systems or security-analysis products. The results can then be uploaded to GitHub using an appropriate workflow action, API, or supported integration. YAML is commonly used for GitHub Actions workflow configuration but is not the interchange format for code scanning findings. ESLint is an analysis tool rather than a results-exchange specification, and ECMAScript defines JavaScript language standards. Therefore, SARIF is the required output format.

Using the Custom setting allows you to subscribe to specific event types, such as Dependabot alerts or vulnerability notifications, without being overwhelmed by all repository activity. This is essential for repository maintainers who need fine-grained control over what kinds of events trigger notifications.

This setting is configurable per repository and allows users to stay aware of critical issues while minimizing notification noise.

Secrets committed and then deleted are still accessible in the repository’s Git history . To locate them, navigate to the Commits tab. GitHub's secret scanning can detect secrets in both current and historical commits, which is why remediation should also include revoking the secret , not just removing it from the latest code.

GitHub allows organization owners and repository administrators to grant additional people or teams access to repository security alerts, including Dependabot alerts, but the recipients must already have write access to that repository. Users with write, maintain, or admin access can normally view relevant repository security alerts, while additional alert-access assignments are also constrained by repository access. A team that merely has Read access to another repository does not satisfy this requirement. Similarly, an outside collaborator with only Read access or an enterprise member who has not been assigned access to the repository cannot be granted the alert access described by the question. Therefore, members of a team that has Write access to the affected repository meet GitHub's permission requirement.

Dependabot alerts are generated as soon as GitHub detects a known vulnerability in one of your dependencies. GitHub does this by analyzing your repository’s dependency graph and matching it against vulnerabilities listed in the GitHub Advisory Database. Once a match is found, the system raises an alert automatically without waiting for a PR or manual action.

This allows organizations to proactively mitigate vulnerabilities as early as possible, based on real-time detection.

When a public repository contains credentials that match known secret formats, GitHub will automatically notify the service provider that issued the secret. This process is known as "secret scanning partner notification" . The provider may then revoke the secret or contact the user directly.

GitHub does not publicly display the alert and does not send internal repository notifications for public detections.

Current GitHub documentation requires Write access or higher to list, dismiss, and delete code scanning alerts. The PDF marks Triage, but that is not correct under the current repository-role permissions documented by GitHub. A user with Triage access can view code scanning alerts associated with pull requests, but Triage does not grant the broader permission required to manage the repository's code scanning alert list. Because Write is not one of the supplied choices, Maintain is the lowest listed role that exceeds Write and therefore has the required management capability. Read access does not permit alert management, and “View” is not one of GitHub's standard organization repository roles in this context. Accordingly, based on current official documentation, the technically correct option from the choices provided is B. Maintain.

To change the threshold that defines whether a pull request fails due to code scanning alerts (such as blocking merges based on severity), the user must have Admin access on the repository. This is because modifying these settings falls under repository configuration privileges.

Users with Write, Maintain, or Triage roles do not have the required access to modify rulesets or status check policies.

Dependency review and secret scanning are capabilities associated with GitHub Advanced Security. In GitHub's current product structure, dependency review is included with GitHub Code Security, while secret scanning is a central capability of GitHub Secret Protection. Both products are components of the broader GitHub Advanced Security offering, and legacy GHAS licenses can include the combined capabilities. The dependency graph is an important supply-chain feature and provides the underlying dependency inventory, but it is broadly available beyond the licensed GHAS feature set and is enabled by default for public repositories. A repository security policy, normally provided through SECURITY.md, is also a general repository capability rather than one of the licensed Advanced Security features being tested. Therefore, dependency review and secret scanning are the correct selections.

Code scanning merge requirements and severity thresholds are repository configuration controls and are therefore managed from the repository's Settings area. In GitHub's current interface, administrators can create a branch ruleset under Settings and configure Require code scanning results. They can then select the code scanning tool and specify alert thresholds, including which normal alerts or security-severity levels should prevent merging. The Security and quality tab is primarily where security findings are reviewed and triaged, while the Actions tab displays workflow execution information. The Pull Requests tab is used to review and merge proposed changes rather than configure repository-wide code scanning policy. Thus, although GitHub's implementation has evolved toward ruleset-based merge protection, the appropriate top-level location remains the repository's Settings tab.

GitHub explicitly notifies the commit author when that person accidentally commits a detected secret, regardless of the author's notification preferences. Repository administrators are also among the users eligible to receive secret-scanning security notifications, subject to their repository watch and email notification configuration. GitHub's current notification model can additionally notify security managers and users with explicitly granted security-alert access, but those choices are not represented accurately by the generic “security analyst” option. Write and Maintain roles alone do not make a user the default repository-wide recipient represented by this question. For incremental scans, users who have security-alert access receive notifications according to their configured notification preferences, while commit authors receive notification regardless. Therefore, among the supplied choices, the expected combination remains the committer and repository administrators: B and C.

When multiple instances of the same secret value appear in a repository, only one alert is generated. Secret scanning works by identifying exposed credentials and token patterns, and it groups identical matches into a single alert to reduce noise and avoid duplication.

This makes triaging easier and helps teams focus on remediating the actual exposed credential rather than reviewing multiple redundant alerts.

Comprehensive and Detailed Explanation:

For code scanning to be triggered on a specific branch, the branch must contain the appropriate workflow file, typically located in the .github/workflows directory. This YAML file defines the code scanning configuration and specifies the events that trigger the scan (e.g., push, pull_request).​

Without the workflow file in the branch, GitHub Actions will not execute the code scanning process for that branch. The repository's visibility (private or public), the status of secret scanning, or the activity level of developers do not directly influence the triggering of code scanning.​

By default , no repositories receive Dependabot alerts unless configuration is explicitly enabled. GitHub does not enable Dependabot alerts automatically for any repositories unless:

The feature is turned on manually

It's configured at the organization or enterprise level via security policies

This includes public, private, and enterprise-owned repositories — manual activation is required .

By default, Dependabot creates pull requests without automatically assigning any reviewers, so the correct number is zero. Reviewers can be configured explicitly through Dependabot configuration or assigned through repository mechanisms such as CODEOWNERS. GitHub recommends using appropriate ownership and review processes when particular teams should review dependency updates. This default differs from Dependabot's ability to create pull requests automatically: creating the update does not imply that a reviewer is selected automatically. A repository can customize Dependabot behavior through .github/dependabot.yml, including configuration related to update handling, but in the scenario specified there is no such configuration file. Consequently, no individual reviewer is automatically attached to the Dependabot pull request merely because Dependabot created it.

To exclude .txt and .md files from triggering workflows on pull requests to the main branch:

on: defines the event (e.g., pull_request)

pull_request: is the trigger

paths-ignore: is the key used to ignore file patterns

Example YAML:

yaml

CopyEdit

on:

pull_request:

branches:

- main

paths-ignore:

- '*.md'

- '*.txt'

Using paths: would include only specific files instead — not exclude. paths-ignore: is correct here.

A GitHub personal access token (PAT) is a credential and is therefore a type of value that secret scanning is designed to detect. GitHub supports patterns for GitHub-issued tokens and can generate secret scanning alerts when supported PAT formats are committed to repositories. GitHub also performs validity checks for certain GitHub tokens and can distinguish active from inactive credentials. SQL injection, cross-site scripting, and server-side request forgery are application vulnerabilities rather than exposed credentials; those issues are detected through code scanning tools such as CodeQL. The distinction is important: secret scanning looks for credentials, API keys, passwords, tokens, and similar sensitive values, whereas code scanning analyzes source code for insecure programming patterns. Therefore, only the GitHub PAT belongs to secret scanning.

GitHub Advanced Security features can be managed at both the organization and repository levels. Organization owners can control security configurations and Advanced Security access across repositories from the organization's Settings area. At the repository level, administrators can manage eligible security and analysis features through the repository's Settings, subject to any policies or security configurations enforced by the organization or enterprise. Current GitHub terminology separates Advanced Security into products such as GitHub Secret Protection and GitHub Code Security, but the same management hierarchy applies. The organization's Repository permissions area manages general repository access permissions rather than feature licensing or enablement, while enterprise settings primarily establish higher-level policies rather than directly serving as the normal per-repository control described here.

At organization scope, enabling Dependabot alerts broadly applies the feature to the organization's eligible repositories, rather than limiting it solely to private repositories or repositories licensed for the broader GitHub Advanced Security product. Dependabot alerts support public, private, and internal repositories, subject to repository eligibility and applicable organization or enterprise configuration. GitHub's current documentation describes organization-level management as enabling Dependabot alerts across all eligible repositories through security configurations. The feature is distinct from licensed GitHub Code Security or Secret Protection capabilities, so the setting is not restricted merely to repositories where those products are enabled. Consequently, All repositories is the intended answer in the supplied choices, with the practical qualification that GitHub applies the configuration to repositories that are eligible for the feature.