GITHUB-ADVANCED-SECURITY Practice Questions

A CodeQL query suite is a file with a .qls extension that defines a set of queries to run. These files use a specific YAML-based format to specify rules for selecting queries. You can include queries by their path, by the directory they are in, or by their metadata properties (e.g., @tags, @kind). This allows for the creation of custom, reusable sets of queries tailored for a specific analysis, such as running only high-precision security queries.

A. .yml: This extension is used for configuration files, such as the GitHub Actions workflow file (codeql-analysis.yml), which invokes a query suite but does not define it.

B. .ql: This is the file extension for a single, executable CodeQL query. A query suite is a collection of these .ql files, not a single file.

C. .qll: This is the file extension for a CodeQL library. These files contain reusable predicates and classes that are imported by .ql files but are not executable queries themselves.

1. GitHub Docs, "Creating CodeQL query suites": "A query suite is a .qls file that allows you to select queries to run based on certain properties, such as their name, location on disk, or metadata." This document explicitly defines the purpose and extension of query suite files.

2. GitHub Docs, "About CodeQL queries": This page distinguishes between the different file types. It states, "CodeQL queries are stored in files with a .ql extension." and "Query libraries are files with a .qll extension... They are not queries themselves, but they contain useful modules, classes, and predicates that can be used in queries." This clarifies the roles of .ql and .qll files.

3. GitHub Docs, "Configuring default setup for code scanning": In the section "Specifying query suites," the documentation shows how a .yml configuration file references a .qls file (e.g., queries: ./path/to/custom-queries.qls), demonstrating the distinct roles of the two file types.

When secret scanning is enabled for a repository, GitHub initiates a scan of the entire Git history across all branches. This process is a non-intrusive, read-only analysis where the content is checked against a set of patterns for known secret formats. This scan does not alter the repository's code or history. If a potential secret is identified, GitHub creates a security alert, which is visible to repository administrators and the organization owners, and notifies the committer.

A. Dependabot alerts are related to vulnerable dependencies, which is a separate GitHub security feature and not directly enabled or affected by activating secret scanning.

B. Notifications for secret scanning alerts are sent to specific individuals, such as repository administrators and the commit author, not an entire team by default subscription.

D. Enabling secret scanning is a distinct action. It does not automatically enable other GitHub Advanced Security features like code scanning or dependency review, which require separate configuration.

1. GitHub Docs, "About secret scanning." This document states, "When you enable secret scanning for a repository, GitHub scans the code for patterns that match secrets... Secret scanning scans the entire Git history on all branches present in your GitHub repository for secrets." This confirms the read-only analysis of the repository's content.

2. GitHub Docs, "Configuring secret scanning for your repositories." This guide details the steps to enable the feature, clarifying that it is a distinct process from configuring other security tools. It notes, "You can enable secret scanning for any public repository... For private or internal repositories, you must have a license for GitHub Advanced Security." This separation of configuration confirms that enabling one feature does not enable all.

3. GitHub Docs, "Managing alerts from secret scanning." This page describes the notification process: "When a new secret is detected, GitHub notifies the repository administrators... and the author of the commit..." This contradicts the idea of a broad team subscription.

When GitHub's Dependabot detects a vulnerable dependency in a repository, it generates a security alert. This alert is based on information from the GitHub Advisory Database. A fundamental component of this alert is a description of the vulnerability, which explains the nature of the security flaw (e.g., Cross-Site Scripting, Remote Code Execution). This description, along with a severity level and recommended patched version, provides the necessary context for developers to understand the risk and take appropriate action.

A. The security impact of these changes: This is imprecise. The alert concerns a vulnerability in the current dependency state, not necessarily a recent change. While a severity level (impact) is included, the description is more fundamental.

B. An easily understandable visualization of dependency change: This describes the dependency graph feature, which helps identify dependency relationships, but it is not the primary content of the vulnerability warning message itself.

C. How many projects use these components: This is general ecosystem metadata about a package's popularity. It is not included in a specific security alert for an individual repository.

1. GitHub Docs, "About Dependabot alerts": This document explains that alerts are generated for dependencies with known vulnerabilities. It states, "Each Dependabot alert contains a link to the full vulnerability advisory, which includes information about the vulnerability, its severity, the affected versions, [and] the patched version..." The core "information about the vulnerability" is its description.

Source: GitHub, Inc. (2024). About Dependabot alerts. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts.

2. GitHub Docs, "Viewing and updating Dependabot alerts": This page shows the user interface for a Dependabot alert. The full alert details page explicitly includes a "Description" section, which details the nature of the vulnerability, directly sourced from the corresponding security advisory.

Source: GitHub, Inc. (2024). Viewing and updating Dependabot alerts. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts.

3. GitHub Docs, "About the GitHub Advisory Database": This document details the structure of the security advisories that power Dependabot alerts. It explicitly lists the "description of the vulnerability" as a key piece of information contained within each advisory.

Source: GitHub, Inc. (2024). About the GitHub Advisory Database. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/security-advisories/global-security-advisories/about-the-github-advisory-database.

Custom patterns are an extension of the core secret scanning functionality within GitHub Advanced Security. The ability to define, configure, and use these custom patterns is contingent upon the base secret scanning feature being active. Therefore, enabling secret scanning for the repository (or organization) is the fundamental prerequisite before you can proceed with defining any custom detection rules. Without the core service running, there is no mechanism to process or apply the custom patterns.

A. Changing repository visibility is not a prerequisite. Custom patterns can be defined for any repository where GitHub Advanced Security is enabled, which includes private and internal repositories.

B. Closing other secret scanning alerts is an unrelated administrative task. The state of existing alerts has no bearing on the ability to configure new detection patterns.

C. Specifying additional match criteria is a step within the process of defining a custom pattern, not a prerequisite to starting that process.

1. GitHub Docs, "Defining custom patterns for secret scanning." In the introductory section, the documentation explicitly states: "Before you can define a custom pattern for secret scanning, you must enable secret scanning for your repository or organization." This directly confirms that enabling the feature is the primary prerequisite.

2. GitHub Docs, "Managing security and analysis settings for your repository." This document outlines the process for enabling or disabling GitHub Advanced Security features. Under the "Enabling or disabling security and analysis features" section, it shows that "GitHub Advanced Security" must be enabled, which in turn allows for the configuration of its components like "Secret scanning." This establishes the enabling step as the gateway to further configuration.

3. GitHub Docs, "About secret scanning." The section "About custom patterns for secret scanning" describes custom patterns as a feature that builds upon the existing secret scanning service, reinforcing that the base service must be active first.

In the context of GitHub, a security policy is a specific file, SECURITY.md, that is added to a repository. The purpose of this file is to provide clear, public instructions to security researchers and users on the responsible and private process for reporting security vulnerabilities they may have discovered in the project. By centralizing these instructions, repository maintainers can manage incoming vulnerability reports more effectively and prevent premature public disclosure. GitHub integrates this file by linking to it from the repository's "Security" tab and when users open new issues.

A. This describes code scanning (e.g., using CodeQL), a feature that automatically analyzes code for potential security vulnerabilities.

B. This describes a GitHub Security Advisory, which is a formal mechanism for disclosing, discussing, and resolving a vulnerability.

D. This describes Dependabot alerts, a feature that automatically detects and alerts developers about vulnerable dependencies in their project.

1. GitHub Docs, "Adding a security policy to your repository." This official documentation explicitly states, "To give people instructions for reporting security vulnerabilities in your project, you can add a SECURITY.md file to your repository's root, docs, or .github folder." It details how this file functions as the repository's security policy.

2. GitHub Docs, "About coordinated disclosure of security vulnerabilities." This document outlines best practices for vulnerability reporting and references the security policy (SECURITY.md) as a key tool for maintainers: "To facilitate reporting, add a security policy to your repository... GitHub will display a link to your security policy on your repository's security tab."

Configuring the rules for code scanning, including the severity thresholds that cause a pull request check to fail, is a critical repository security setting. According to official GitHub documentation, only users with administrative permissions for a repository have the authority to modify these settings. This restriction ensures that the repository's security posture is managed by authorized personnel and prevents contributors or maintainers from weakening security enforcement policies. The setting is located under the repository's "Settings" > "Code security and analysis" section, which is accessible only to administrators.

A. Maintain: The maintain role can manage many repository settings but does not have permission to alter fundamental security configurations like code scanning failure conditions.

B. Write: The write role allows users to contribute code and manage pull requests but does not grant access to configure repository-level security settings.

C. Triage: The triage role is limited to managing issues and pull requests and can dismiss alerts, but it cannot configure the rules that generate those alerts.

1. GitHub Docs, "Configuring pull request checks." This document explicitly states the permission required for this task.

Reference: In the section "Configuring pull request checks," the documentation states, "People with admin permissions for a repository can configure code scanning to check the code in a pull request."

Source: GitHub, Inc. (2024). Configuring pull request checks. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code/configuring-pull-request-checks

2. GitHub Docs, "Repository roles for an organization." This page details the capabilities of each role, confirming that managing security settings is an admin-level privilege.

Reference: The permissions table shows that only the "Admin" role has the ability to "Manage repository settings," which includes security features like code scanning rules.

Source: GitHub, Inc. (2024). Repository roles for an organization. GitHub Docs. Retrieved from https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization

Fixing a code scanning alert requires modifying the source code and committing the changes to the repository. This action is fundamentally tied to the ability to write to the repository. According to GitHub's permission model, only users with 'write' permissions (or higher, such as 'maintain' or 'admin') can push commits to a repository's branches. While other roles can manage the alert itself (e.g., view or dismiss it), they lack the necessary permissions to alter the code and resolve the underlying vulnerability.

A. Users who have the Triage role within the repository: The Triage role allows users to manage alerts (e.g., dismiss them) but does not grant permission to write code, which is necessary for a fix.

B. Users who have Read permissions within the repository: Read permissions only allow for viewing code and alerts. Users with this role cannot modify code, push commits, or manage alerts in any way.

D. Users who have the security manager role within the repository: The security manager role grants permissions to manage security settings and alerts (view, dismiss, reopen), but it does not inherently include write access to the code.

---

1. GitHub Docs, "Managing code scanning alerts for your repository." Under the section "Fixing alerts," the documentation explicitly states: "Anyone with write permissions for a repository can fix a code scanning alert in that repository." This directly supports the correct answer.

Source: https://docs.github.com/en/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#fixing-alerts

2. GitHub Docs, "Repository roles for an organization." This document details the abilities associated with each permission level. It confirms that the 'Write' role is the minimum level required to "Push to the repository's unprotected branches," the essential action for fixing code.

Source: https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization (See the "Permissions for repository roles" table).

3. GitHub Docs, "Permissions for dismissing alerts." This page clarifies that dismissing an alert requires write, maintain, or admin permissions. While the Triage role can also be granted this ability, it is distinct from fixing the code.

Source: https://docs.github.com/en/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#permissions-for-dismissing-alerts

4. GitHub Docs, "Managing security managers in your organization." This source defines the scope of the security manager role, highlighting its focus on managing security policies and alerts, not on direct code contribution.

Source: https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization#about-the-security-manager-role

GitHub code scanning is implemented as a GitHub Actions workflow. For a workflow to execute in response to an event on a specific branch (e.g., a push or pullrequest), the YAML workflow file that defines the job and its triggers must be present in the .github/workflows directory of that branch. When an event occurs, GitHub checks the commit SHA associated with that event for a relevant workflow file. If the file does not exist in that branch's context, GitHub Actions has no instructions to run the code scan.

A. The repository must be private.

Code scanning is available for free on all public repositories and is not restricted to private ones.

B. Secret scanning must be enabled on the repository.

Secret scanning and code scanning are independent features of GitHub Advanced Security; one is not a prerequisite for the other.

C. Developers must actively maintain the repository.

Workflows are triggered by specific, configured events (like a push), not by a general state of "active maintenance."

1. GitHub Docs, "Configuring default setup for code scanning." This document states, "When you set up default setup for code scanning, GitHub Actions creates a workflow file in your repository... For a workflow to run, its workflow file must be in the branch that the event occurred in." This directly confirms that the workflow file must exist in the target branch.

2. GitHub Docs, "Events that trigger workflows." Under the section "Choosing the workflow file," it explains: "When an event occurs on your repository, GitHub will identify the workflow files that are in the Git ref (branch or tag) associated with that event." This reinforces that the workflow's existence in the specific branch is the determining factor for it to be triggered.

3. GitHub Docs, "About GitHub Advanced Security." This page clarifies the availability of features: "GitHub Advanced Security features are enabled for all public repositories on GitHub.com." This directly refutes the claim that a repository must be private.

The dependency review feature in GitHub Advanced Security is implemented via the dependency-review-action. This action is primarily designed to run on the pullrequest event. This allows it to scan for dependency changes and vulnerabilities introduced in a pull request before they are merged into the main branch, displaying results directly in the pull request's "Files Changed" tab.

The action can also be triggered manually using the workflowdispatch event. This provides the flexibility to run a dependency scan on-demand against any branch, outside of the standard pull request lifecycle, for auditing or specific security checks.

C. trigger is a generic term and not a valid event keyword used in the on: section of a GitHub Actions workflow file.

D. commit is not a valid event keyword for triggering a GitHub Actions workflow. The correct event for commits being pushed to a repository is push.

1. GitHub Docs, "Configuring dependency review": The official documentation provides an example workflow that explicitly uses on: pullrequest to trigger the dependency review action.

Reference: See the "Example workflow" section.

URL: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/configuring-dependency-review

2. GitHub Docs, "Events that trigger workflows": This document lists all valid events for GitHub Actions. It confirms that pullrequest and workflowdispatch are valid events, while trigger and commit are not.

Reference: The list of events on the page.

URL: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows

3. GitHub Marketplace, "Dependency Review Action": The official page for the action states, "This action scans your pull requests for dependency changes and will fail if it finds any vulnerable dependencies." This highlights pullrequest as the primary trigger.

Reference: Main description paragraph.

URL: https://github.com/marketplace/actions/dependency-review

Dependabot pull requests for security updates are managed like any other pull request within a repository. The ability to merge a pull request is determined by the repository's access permissions. The standard permission level required to merge pull requests is 'write' access. Users with this level of access can push changes to the repository and manage pull requests, including those automatically generated by Dependabot. Since the question specifies no custom configurations, these default GitHub permissions apply.

A. An enterprise administrator can merge pull requests, but this is not the minimum required permission. The 'write access' role is the more precise and fundamental requirement.

C. A user with 'read' access can only view repository content and open issues. They do not have the necessary permissions to merge pull requests or modify the repository's code.

D. Membership in an enterprise organization does not inherently grant merge permissions. A member must be assigned a specific role with at least 'write' access to the repository in question.

---

1. GitHub Docs, "Repository roles for an organization." This document explicitly lists the abilities associated with each permission level. For the "Write" role, it includes the ability to "Merge pull requests."

Reference: In the table under the "Permissions" section, the row for "Merge pull requests" has a checkmark for the "Write," "Maintain," and "Admin" roles.

2. GitHub Docs, "Managing pull requests for dependency updates." This page clarifies that Dependabot pull requests are handled similarly to user-created ones.

Reference: Under the section "Viewing Dependabot pull requests," it states, "You can manage Dependabot pull requests in the same way as any other pull request..." This confirms that standard repository permissions apply.

3. GitHub Docs, "About Dependabot security updates." This document describes the process of Dependabot creating a pull request to fix a vulnerability, which is then reviewed and merged by repository maintainers.

Reference: Under the section "About pull requests for Dependabot security updates," it describes the pull request creation, implying it follows the standard workflow for review and merging by authorized users.