Explain how to interpret a Code Scanning alert's 'Severity' and 'Confidence' fields.

• A. Severity indicates risk impact; Confidence indicates certainty of the finding.
• B. Severity indicates the number of lines changed; Confidence indicates code complexity.
• C. Severity indicates patch difficulty; Confidence indicates vendor support.
• D. Severity indicates how recently it was introduced; Confidence indicates how many times detected.

Answer: (A)

Severity reflects the potential impact or risk if the finding were exploited, helping you prioritize which issues pose the biggest threat. Confidence shows how certain the scanner is that the finding is real—the likelihood that it’s a true vulnerability rather than a false positive.

Together, they guide triage: a high-severity alert with high confidence demands prompt attention; a high-severity alert with lower confidence may need human verification before acting; lower-severity issues can be scheduled with lower urgency. The other options describe metrics unrelated to how Code Scanning presents risk and certainty.