Free Microsoft GH-500 Practice Exam with Questions & Answers | Set: 2

To proactively address secret scanning:

Webhooks can be configured to listen for secret scanning events. This allows automation, logging, or alerting in real-time when secrets are detected.

Documenting secure development practices (like using environment variables or secret managers) helps reduce the likelihood of developers committing secrets in the first place.

Dismissal based on age is not a best practice without triage. SCIM deals with user provisioning, not scanning alerts.

Comprehensive and Detailed Explanation:

For code scanning to be triggered on a specific branch, the branch must contain the appropriate workflow file, typically located in the .github/workflows directory. This YAML file defines the code scanning configuration and specifies the events that trigger the scan (e.g., push, pull_request).​

Without the workflow file in the branch, GitHub Actions will not execute the code scanning process for that branch. The repository's visibility (private or public), the status of secret scanning, or the activity level of developers do not directly influence the triggering of code scanning.​

When multiple instances of the same secret value appear in a repository, only one alert is generated. Secret scanning works by identifying exposed credentials and token patterns, and it groups identical matches into a single alert to reduce noise and avoid duplication.

This makes triaging easier and helps teams focus on remediating the actual exposed credential rather than reviewing multiple redundant alerts.

When a CodeQL workflow uses a language matrix, the matrix explicitly defines which programming languages the workflow analyzes. GitHub states that CodeQL will analyze only the languages included in that matrix; adding or removing matrix entries therefore directly changes the languages scanned. The matrix also allows separate language-analysis jobs to run in parallel, so it does not inherently make analysis sequential. The languages input of the CodeQL init action commonly receives the current matrix.language value, but that describes how the matrix value is passed into CodeQL rather than the principal impact asked for here. The matrix also does not represent dependency exclusions. Consequently, the operational effect being tested is that CodeQL analysis is restricted to the languages explicitly included in the workflow's matrix.

The GitHub Code Scanning API includes endpoints that allow you to:

List alerts for a repository (filtered by branch, state, or tool) — useful for monitoring security over time.

Get a single alert by its ID to inspect its metadata, status, and locations in the code.

However, GitHub does not support modifying the severity of alerts via API — severity is defined by the scanning tool (e.g., CodeQL). Likewise, alerts cannot be deleted via the API; they are resolved by fixing the code or dismissing them manually.

In a query suite (a .qls file), the **query** key is used to specify the paths to one or more .ql files that should be included in the suite.

Example:

- query: path/to/query.ql

qls is the file format.

qlpack is used for packaging queries, not in suite syntax.

The config-file input is used with the github/codeql-action/init action to specify the path to a custom CodeQL configuration file. This configuration can define additional query packs, custom queries, directories to include or exclude, and other CodeQL analysis settings. GitHub's official workflow documentation shows config-file under the with: section of the CodeQL initialization step. The queries input is used to specify additional query suites or query packs directly, rather than referencing a configuration file. source-root and db-location are not the appropriate init inputs for supplying the configuration-file path. Therefore, when the CodeQL workflow must load settings from a separate YAML configuration file, config-file is the correct parameter.

At organization scope, enabling Dependabot alerts broadly applies the feature to the organization's eligible repositories, rather than limiting it solely to private repositories or repositories licensed for the broader GitHub Advanced Security product. Dependabot alerts support public, private, and internal repositories, subject to repository eligibility and applicable organization or enterprise configuration. GitHub's current documentation describes organization-level management as enabling Dependabot alerts across all eligible repositories through security configurations. The feature is distinct from licensed GitHub Code Security or Secret Protection capabilities, so the setting is not restricted merely to repositories where those products are enabled. Consequently, All repositories is the intended answer in the supplied choices, with the practical qualification that GitHub applies the configuration to repositories that are eligible for the feature.

GitHub enables the dependency graph by default for public repositories. The graph analyzes supported manifest and lock files and identifies dependencies declared in those files. When a dependency is added or changed in a supported manifest on the repository's default branch, GitHub updates the dependency graph automatically. Private repositories can also use the dependency graph, but the feature must be enabled unless an organization or enterprise configuration enables it automatically. Forking a repository does not itself constitute the dependency declaration that this question describes. Therefore, under default settings, adding a new dependency to a manifest in a public repository is the scenario that causes GitHub's dependency graph to identify and represent that dependency.

By default, secret scanning is enabled automatically for all public repositories . For private or internal repositories, secret scanning must be enabled manually unless configured at the organization or enterprise level.

This default behavior helps protect open-source projects without requiring additional configuration.