GitHub Advanced Security (GHAS) Certification

What is GitHub Advanced Security (GHAS)?

• AA backup service for GitHub repositories
• BA suite of security features including code scanning (CodeQL), secret scanning, and depen…
• CA static website hosting service
• DAn identity provider

Which language and analysis engine powers default code scanning in GitHub?

• ACodeQL
• BESLint only
• CSonarQube only
• DSnyk only

What's the difference between default and advanced setup for code scanning?

• ADefault uses GitHub-managed configuration with auto-detection; advanced uses a customizab…
• BDefault is paid; advanced is free
• CDefault uses CodeQL; advanced uses ESLint
• DThere is no default setup

Which feature blocks commits containing secrets at git push time?

• ABranch protection rules
• BPush protection (part of secret scanning)
• CCode scanning
• DDependency review

What does Dependabot alerts do?

• AAutomatically deletes vulnerable dependencies
• BNotifies repository owners about known vulnerabilities in dependencies (via GitHub Adviso…
• CEncrypts dependency files
• DRemoves all dependencies

What does dependency review in pull requests show?

• AA view of dependency changes (added/removed/updated) in a PR with vulnerability and licen…
• BA list of all repository contributors
• CCode formatting issues
• DTest coverage

Which CodeQL query suite is recommended for finding common security vulnerabilities?

• Asecurity-and-quality (broader) or security-extended (deeper) — security-extended is more…
• Bcode-style only
• Cformat-check only
• Dperformance-tuning only

Which is a key difference between secret scanning for public vs. private repositories?

• ASecret scanning for public repos is free for all GitHub users; secret scanning for privat…
• BIt's identical
• CPublic is paid; private is free
• DPublic is unsupported

What is a custom secret pattern in GitHub secret scanning?

• AA user-defined regex pattern to detect organization-specific secrets (e.g., internal API…
• BA built-in pattern only Microsoft can edit
• CA type of branch
• DA repository topic

Which feature provides organization-wide visibility into security alerts across repositories?

• ASecurity Overview dashboard
• BPull request reviews
• CGitHub Pages
• DRepository Insights

What are security campaigns in GHAS?

• AMarketing campaigns from GitHub
• BTime-bound security improvement initiatives that group related alerts and track resolutio…
• CGitHub Issues
• DPull requests

Which CodeQL feature suggests automatic fixes for some vulnerabilities?

• ACode scanning autofix (powered by GitHub Copilot)
• BDependabot only
• CSecret scanning
• DBranch protection

Which GitHub feature integrates with branch protection to require code scanning to pass before merging?

• ARequired status checks (in branch protection rules)
• BGitHub Pages
• CIssue templates
• DWebhooks only

What language does CodeQL use for writing custom queries?

• AJavaScript
• BQL (a declarative, object-oriented query language designed for code analysis)
• CPython
• DYAML

Which Dependabot feature creates pull requests to update dependencies to non-vulnerable versions?

• ADependabot security updates
• BDependabot version updates
• CGitHub Pages
• DBranch protection

Which file configures Dependabot for a repository?

• A.github/dependabot.yml
• Bpackage.json
• C.gitignore
• DREADME.md

Which is the recommended action when a developer needs to commit code that contains a placeholder secret (e.g., 'YOUR_API_KEY_HERE') that triggers push protection?

• ABypass push protection with a justification (e.g., 'used as placeholder') — the bypass is…
• BCommit a real secret
• CDisable push protection org-wide
• DChange the project

Which is true about CodeQL database creation?

• ACodeQL builds a structured database (CodeQL database) representing the code, then runs qu…
• BCodeQL doesn't use a database
• CCodeQL only analyzes one file at a time
• DCodeQL database is a SQL database

Which type of vulnerability does CodeQL specialize in detecting?

• ACommon security vulnerabilities (SQL injection, XSS, path traversal, command injection, d…
• BLicense violations only
• CCode formatting only
• DBuild performance only

Which is a true statement about secret scanning's partner program?

• AService providers (AWS, Google, Stripe, etc.) can join the partner program — when GitHub…
• BOnly Microsoft secrets are detected
• CThere is no partner program
• DPartners pay GitHub

Which is a common configuration for a CodeQL workflow file?

• AUse the github/codeql-action with a matrix of languages, run on push/pull_request trigger…
• BInstall Python only
• CRun only on Mondays
• DDisable triggers

Which Dependabot feature lets you ignore specific dependencies or version ranges?

• AThe 'ignore' configuration in dependabot.yml (e.g., specific dependency name and version…
• BBranch protection
• CPush protection
• DWebhooks

Which permission is required to view security alerts in a GitHub repository?

• ARead access at minimum to see Dependabot alerts (depending on repo settings); admin acces…
• BPublic access only
• CAnonymous access
• DIssue creation only

What is the SARIF format used for in GitHub code scanning?

• AA JSON-based standard format (Static Analysis Results Interchange Format) for representin…
• BA type of secret
• CA branch type
• DA package format

Which approach minimizes false positives in CodeQL scanning?

• AUse the appropriate query suite (default vs. extended), tune queries (or write filters),…
• BDisable code scanning
• CIgnore all alerts
• DAuto-close alerts

What does the github/codeql-action/upload-sarif action do?

• AUploads SARIF results from any tool to GitHub code scanning so alerts appear in the Secur…
• BDownloads code
• CBuilds code
• DDeletes alerts

Which is a recommended best practice for managing secret scanning alerts?

• ATriage alerts promptly (revoke/rotate the leaked credential, then close as resolved), tra…
• BIgnore secrets
• CWait for breach
• DAuto-close all secret alerts

Which is a true statement about Dependabot's effect on a repo?

• ADependabot opens PRs that maintainers must review and merge — it doesn't auto-merge by de…
• BDependabot auto-merges all PRs
• CDependabot deletes dependencies
• DDependabot encrypts code

Which environment is required for GHAS in GitHub Enterprise Server (GHES)?

• AA licensed instance of GHES with GHAS feature enabled, plus typical compute and storage r…
• BGHES Free tier
• CGitHub Pages
• DOn-premises only without GHES

Which command-line tool is used to run CodeQL queries locally?

• AThe CodeQL CLI
• Bgit
• Cnpm
• Ddocker

Which feature lets organizations require code scanning to be enabled across all repositories?

• ACode security configurations (organization-level) that enforce code scanning, secret scan…
• BBranch protection only
• CWebhooks
• DCode review only

Which is the difference between secret scanning historical scan and incremental scan?

• AHistorical scans cover the entire git history of a repo; incremental scans cover only new…
• BThere is no difference
• CHistorical is faster
• DBoth scan only the README

What does 'CodeQL pack' refer to?

• AA reusable bundle of CodeQL queries (and supporting libraries) that can be published, ver…
• BA type of branch
• CA binary executable
• DA README file

Which scenario shows good integration between GHAS and CI/CD?

• ACode scanning runs on PRs (blocking merge on new high-severity alerts), Dependabot update…
• BDisable all checks
• CManual security reviews only
• DSkip security in CI

Which is a typical reason to disable CodeQL for a specific repository?

• AThe repo language isn't supported, the build is too complex/long for default setup, or th…
• BAll security is unnecessary
• CRepos shouldn't have security
• DDisable for all repos

Which is true about Dependabot for Docker dependencies?

• ADependabot can monitor base images in Dockerfiles and open PRs to update to newer (less v…
• BDocker is unsupported
• COnly npm is supported
• DManual updates only

Which feature in Security Overview shows trends in alert resolution over time?

• ASecurity risk and coverage views — trends, average time to remediate, alert age distribut…
• BGitHub Pages
• CIssues view
• DDiscussions

What is the correct way to mark a code scanning alert as a false positive?

• ADismiss the alert in the GitHub UI with a reason ('false positive', 'won't fix', 'used in…
• BDelete the file
• CForce push to main
• DChange branch protection

Which is a recommended pattern for organizations adopting GHAS at scale?

• AEstablish a security baseline (code scanning + secret scanning + push protection + Depend…
• BRoll out one feature at a time only
• CDisable security
• DApply to one repo only

Which is true about GHAS pricing?

• AGHAS is licensed per active committer (unique committer in the past 90 days) on top of Gi…
• BFree for all repos
• CPer-repo pricing
• DPer-line-of-code pricing

Which CodeQL feature lets you write a query that excludes test code from analysis?

• APath filters in the codeql-config.yml or in-query exclusions
• BForce push
• CBranch protection
• DWebhooks

Which is the recommended response when secret scanning detects a leaked production credential?

• ARevoke the credential immediately, audit usage, rotate to a new credential, investigate h…
• BIgnore it
• CDelete the alert
• DWait until next quarter

Which CodeQL feature is most useful for finding all places that call a specific dangerous API?

• AA custom CodeQL query targeting that API as a sink, with a flow-graph visualization in al…
• BSearch bar
• CIssue search
• DDependabot

Which is true about secret scanning's coverage of git history?

• ASecret scanning scans the entire git history (including merged branches and historical co…
• BOnly current commits
• COnly main branch
• DOnly README files

Which is a true statement about GHAS and SAML SSO?

• AGHAS works with SAML SSO; for OAuth-required actions (e.g., dependabot setup), users must…
• BGHAS doesn't support SAML SSO
• CGHAS bypasses SAML SSO
• DSAML is required to disable GHAS

Which is a recommended baseline GHAS configuration for a new private repository?

• AEnable code scanning (default setup), secret scanning, push protection, Dependabot alerts…
• BOnly enable code scanning
• CDisable all security
• DOnly secret scanning

Which Dependabot feature is useful for monorepos with multiple subprojects?

• AMultiple package-ecosystem entries with different 'directory' values in dependabot.yml
• BOne global entry only
• CManual config per file
• DWebhooks