Which practice helps reduce the risk of false negatives in CodeQL scanning?

• A. Relying on a single query set.
• B. Disabling language support.
• C. Updating queries, expanding language support, and refining rules.
• D. Ignoring alerts.

Answer: (C)

False negatives in CodeQL scanning occur when a real vulnerability isn’t detected by the analysis. The best way to reduce that risk is to keep the detection logic current and comprehensive: update the queries so they recognize newly discovered vulnerability patterns, expand language support so more parts of your codebase are analyzed, and refine the rules so they accurately identify true issues without missing subtler cases. When queries are outdated, languages aren’t covered, or rules are poorly tuned, real problems can slip through the cracks. By maintaining an up-to-date, broad, and well-tuned set of queries across all relevant languages, you improve coverage and reduce the chance of undetected vulnerabilities.