GHAS Certification Exam Prep: Week Three - CodeQL

[queenofcorgis]

We’re halfway through our prep course for the GHAS certification exam, if you missed Week One’s Discussion and/or Week Two’s Discussion don’t worry feel free to get started and join us when you are caught up. Our latest installment will be focusing on the CodeQL topics in the exam. Our experts are here too to answer questions and share knowledge 💡 .

Plus, prep materials and test questions to continue on studying. As a reminder, we'll be selecting five participants to receive a free GitHub Certifications exam voucher 🎫 .

Step One: Prep 📚

Use these materials to study before answering this week’s prep questions.

• Microsoft Learn Modules
  • Identify security vulnerabilities in your codebase by using CodeQL
  • Code scanning with GitHub CodeQL
• Study guides from @NickLiffen
  • Advanced CodeQL setup
  • Fine-tune testing scope with CodeQL
  • Bonus: Create a central CodeQL configuration file
• Study guides from @LadyKerr
  • Use code scanning with CodeQL
• Videos
  • GitHub Advanced Security - Pass the Exam from freeCodeCamp
    • CodeQL Section
  • Perform Security Code Analysis in GitHub with CodeQL and GitHub Actions
    • YouTube Video

Step Two: Test Your Knowledge ⚡

Question One: Where can you find the codeql.yml workflow file in your repository?

A) In the root directory
B) In the .github/ directory
C) In the scripts/ directory
D) In the src/ directory

Question Two:

What is the purpose of the codeql.yml workflow file in CodeQL advanced setup?

A) To initialize the CodeQL tools for scanning
B) To define test cases for CodeQL
C) To configure repository secrets
D) To manage repository dependencies

Question Three: What are the two options available when setting up CodeQL for the first time?

A) Basic and Advanced
B) Default and Custom
C) Default and Advanced
D) Basic and Custom

Question Four: What is the main benefit of using CodeQL for security analysis?

A) It encrypts all data
B) It compiles the code faster
C) It identifies potential security vulnerabilities
D) It monitors network traffic

We’ll be sharing the answers in the comments on Friday 🧠

Use the discussion below to share additional study resources, ask questions for our team to answer, and respond to our prep questions

[RishavKumarSinha]

Always looking forward to these resources and question set, I find it to be a good way to jog my memory on the topic.

As for for the answers,

Q1. Option B
Q2. Option A
Q3. Option C
Q4. Option C

[davevad93]

Question One: Where can you find the codeql.yml workflow file in your repository?

• A) In the root directory
• B) In the .github/ directory
• C) In the scripts/ directory
• D) In the src/ directory

Question Two: What is the purpose of the codeql.yml workflow file in CodeQL advanced setup?

• A) To initialize the CodeQL tools for scanning
• B) To define test cases for CodeQL
• C) To configure repository secrets
• D) To manage repository dependencies

Question Three: What are the two options available when setting up CodeQL for the first time?

• A) Basic and Advanced
• B) Default and Custom
• C) Default and Advanced
• D) Basic and Custom

Question Four: What is the main benefit of using CodeQL for security analysis?

• A) It encrypts all data
• B) It compiles the code faster
• C) It identifies potential security vulnerabilities
• D) It monitors network traffic

[jccampanero]

Thank you very much for the new content!

These are my answers:

Question One: Where can you find the codeql.yml workflow file in your repository?

A) In the root directory
B) In the .github/ directory
C) In the scripts/ directory
D) In the src/ directory

Question Two: What is the purpose of the codeql.yml workflow file in CodeQL advanced setup?

A) To initialize the CodeQL tools for scanning
B) To define test cases for CodeQL
C) To configure repository secrets
D) To manage repository dependencies

Question Three: What are the two options available when setting up CodeQL for the first time?

A) Basic and Advanced
B) Default and Custom
C) Default and Advanced
D) Basic and Custom

Question Four: What is the main benefit of using CodeQL for security analysis?

A) It encrypts all data
B) It compiles the code faster
C) It identifies potential security vulnerabilities
D) It monitors network traffic

[gitstua]

👋🏽 Hi, @RishavKumarSinha @davevad93 @jccampanero

Great to see you practicing the answers here! Well done! 🚀

Have you started playing around with Advanced Security on public repos? Let the community here know if you have anything you are finding confusing - it's a great community who help each other!