GitHub Advanced Security Certification Pracice Test

Unlock all questions

This demo includes only 20 questions. Upgrade to access hundreds of questions, flashcards, exam simulations, and disable ads.

Full question bankExam simulationsFlashcards

From $25.99Unlock all

Session length

1 / 20

Which components are typically included in a GitHub Advanced Security Code Scanning workflow file?

An HTML report that lists findings

A YAML workflow that triggers on push/PR, checks out code, sets up CodeQL, runs codeql analyze, and uploads SARIF results

The idea being tested is that GitHub Advanced Security code scanning is implemented as a GitHub Actions workflow written in YAML. A typical workflow file triggers on pushes and pull requests so analyses run for each change, checks out the repository to access the code, sets up CodeQL (the analysis engine), runs the analysis with codeql analyze, and then uploads the results in SARIF format back to GitHub. This SARIF upload is what feeds GitHub’s code scanning UI, letting alerts appear under the Security tab and in PR reviews. This workflow pattern—YAML-defined, event-triggered, code checkout, CodeQL setup, code analysis, and SARIF upload—is how code scanning is designed to operate within GitHub.

HTML reports aren’t used by GitHub to surface scanning results, a standalone shell script wouldn’t integrate into GitHub’s code scanning experience, and a JSON manifest doesn’t constitute the actual workflow or result delivery used by code scanning.

A shell script that runs tests and pushes results

A JSON manifest indicating project metadata