GitHub Advanced Security Code Scanning Quiz

1. Which organization setting controls who can enable Advanced Security for repositories?

Branch protection rules

Security and analysis settings

Webhook configuration

SSH key management

2. How does GitHub Advanced Security integrate with CI/CD workflows?

It cannot be integrated into CI/CD

Code scanning can be triggered in GitHub Actions workflows to enforce security gates

It only works with manual testing

Integration requires external tools only

3. What is the primary benefit of GitHub Advanced Security's centralized Security tab?

Provides a single view of all security issues across the repository

Automatically fixes all vulnerabilities

Eliminates the need for security reviews

Replaces traditional code review processes

4. How can teams customize CodeQL analysis for their repositories?

Disable CodeQL entirely

Use custom CodeQL queries or modify default configurations

CodeQL cannot be customized

Only GitHub can modify CodeQL settings

5. Which GitHub Advanced Security feature provides information about known vulnerabilities in dependencies?

Security advisories

Dependabot alerts

Code scanning findings

Secret detection logs

6. What is the relationship between code scanning and pull requests?

Code scanning only runs on merged branches

Code scanning can run on pull requests and block merging if issues are found

Code scanning cannot analyze pull request changes

Code scanning requires manual initiation for each PR

7. How does GitHub Advanced Security help with compliance requirements?

Automatically generates compliance reports

Provides audit logs and security visibility for regulatory needs

Removes the need for external security tools

Eliminates all security risks

8. CodeQL queries are written in which language?

Python

JavaScript

QL (Query Language)

SQL

9. What happens when secret scanning detects a compromised secret in a repository?

The commit is automatically reverted

GitHub notifies the secret's provider and the repository owner

The file is automatically deleted

Access to the repository is blocked

10. Secret scanning in GitHub Advanced Security can detect patterns for which types of secrets?

GitHub tokens, AWS keys, and other provider credentials

Only GitHub personal access tokens

Only passwords in comments

Only hardcoded database connection strings

11. What is the primary purpose of GitHub Advanced Security code scanning?

Detect vulnerabilities and secrets in code

Manage team permissions

Monitor deployment logs

Track project timelines

12. What does the dependency graph in GitHub Advanced Security track?

Repository commit history

Project dependencies and their versions

User access logs

Pull request review times

13. How can developers dismiss or resolve a code scanning alert?

Delete the repository

Review and either fix the issue or dismiss with justification

Disable Advanced Security

Archive the branch

14. What is a security alert in GitHub Advanced Security?

A notification about a detected vulnerability or secret

A warning about slow build times

A reminder to update repository metadata

A message about team member invitations

15. Which of the following is NOT a feature of GitHub Advanced Security?

Code scanning with CodeQL

Secret scanning

Dependency graph analysis

Automatic code compilation

16. When is secret scanning enabled for a GitHub Advanced Security repository?

Only on public repositories

Only on private repositories

On all repositories with Advanced Security enabled

Only after manual configuration

17. What does the Security tab in GitHub display for Advanced Security users?

Deployment history

Code scanning alerts, secret scanning, and dependency vulnerabilities

Team member activity logs

Repository fork statistics

18. How does GitHub Advanced Security handle dependency vulnerabilities?

Automatically removes vulnerable packages

Alerts on vulnerabilities and suggests updates

Blocks repository access

Requires manual package replacement

19. CodeQL is used in GitHub Advanced Security to perform what type of analysis?

Static application security testing (SAST)

Dynamic application security testing (DAST)

Infrastructure scanning

Network penetration testing

20. Which GitHub Advanced Security feature automatically detects exposed credentials and API keys?

Dependency scanning