Pass the GitHub Certification GitHub-Advanced-Security Questions and answers with ExamsMirror

GitHub automatically closes a code scanning alert when the vulnerable code is fixedin the same branch where the alert was generated, usually via acommit inside a pull request. Simply clicking or triaging an alert does not resolve it. The alert is re-evaluated after each push to the branch, and if the issue no longer exists, it is marked as resolved.

Using theCustomsetting allows you to subscribe to specific event types, such as Dependabot alerts or vulnerability notifications, without being overwhelmed by all repository activity. This is essential for repository maintainers who need fine-grained control over what kinds of events trigger notifications.

This setting is configurable per repository and allows users to stay aware of critical issues while minimizing notification noise.

All results from CodeQL analysis appear under therepository’s code scanning alertstab. This section is part of theSecuritytab and provides a list of all current, fixed, and dismissed alerts found by CodeQL.

A CodeQL database is used internally during scanning but does not display results. Query packs contain rules, not results. Security advisories are for published vulnerabilities, not per-repo findings.

Comprehensive and Detailed Explanation:

A CodeQL database contains a representation of your codebase, including the build of the code and extracted data. This database is used to run CodeQL queries to analyze your code for potential vulnerabilities and errors.​

GitHub Docs

Dependency reviewruns as part of a pull request and showswhich dependencies are being added, removed, or changed— andhighlights vulnerabilitiesassociated with any added packages.

It works in real-time and is specifically designed for use during pull request workflows.

Thedependency graphis an overview,Dependabot alertsnotify post-merge, and theSecurity tabshows the aggregated alert list.

To change the threshold that defines whether a pull request fails due to code scanning alerts (such as blocking merges based on severity), the user must haveAdminaccess on the repository. This is because modifying these settings falls under repository configuration privileges.

Users with Write, Maintain, or Triage roles do not have the required access to modify rulesets or status check policies.

Comprehensive and Detailed Explanation:

For code scanning to be triggered on a specific branch, the branch must contain the appropriate workflow file, typically located in the .github/workflows directory. This YAML file defines the code scanning configuration and specifies the events that trigger the scan (e.g., push, pull_request).​

Without the workflow file in the branch, GitHub Actions will not execute the code scanning process for that branch. The repository's visibility (private or public), the status of secret scanning, or the activity level of developers do not directly influence the triggering of code scanning.​

When dealing with a data flow issue in a code scanning alert, clicking on "Show paths" provides a detailed view of the data's journey through the code. This includes the source of the data, the path it takes, and where it ends up (the sink). This information is crucial for understanding how untrusted data might reach sensitive parts of your application and helps in identifying where to implement proper validation or sanitization.​

When apublic repositorycontains credentials that match known secret formats, GitHub willautomatically notify the service providerthat issued the secret. This process is known as"secret scanning partner notification". The provider may then revoke the secret or contact the userdirectly.

GitHub doesnotpublicly display the alert and does not send internal repository notifications for public detections.

Secret scanning is a feature provided by GitHub that scans the contents of your GitHub repositories for known types of secrets, such as API keys and tokens. It operates within the GitHub environment and does not scan external systems, services, or repositories outside of GitHub. Its primary function is to prevent the accidental exposure of sensitive information within your GitHub-hosted code.​