GitHub Advanced Security GHAS - GitHub-Advanced-Security Exam Practice Test

A. codeql-scan.yml B. codeql-config.yml C. codeql-analysis.yml D. codeql-workflow.yml

A. Use jobs.analyze.runs-on. B. Implement custom build steps. C. Upload compiled binaries. D. Use CodeQL's autobuild action. E. Use CodeQL's init action. F. Ignore paths.

A. 3 B. 4 C. 2 D. 1

A. Update the workflow to include a final step that uploads the results. B. Use the CLI to upload results to GitHub. C. The CodeQL action uploads the SARIF file automatically when it completes analysis. D. By default, the CodeQL runner automatically uploads results to GitHub on completion.

A. Search for potential security vulnerabilities, detect secrets, and show the full impact of changes to dependencies B. Confidentially report security vulnerabilities and privately discuss and fix security vulnerabilities in your repository's code C. View alerts about dependencies that are known to contain security vulnerabilities D. Automatically raise pull requests, which reduces your exposure to older versions of dependencies

A. Dependency graph enabled at the organization level for all new private repositories B. Read-only access to all the repository's files C. Read-only access to the dependency manifest and lock files for a repository D. Write access to the dependency manifest and lock files for an enterprise

A. If there is a production error in your code B. To prevent developers from introducing new problems C. If you fix the code that triggered the alert D. If it includes an error in code that is used only for testing

A. Update your dependencies. B. Archive the repository. C. Remove the secret in a commit to the main branch. D. Revoke the alert if the secret is still valid.