Microsoft Updated GH-500 Exam Questions and Answers by nel

When defining a custom pattern for secret scanning, two key fields are required:

Name of the pattern : A unique label to identify the pattern

Secret format : A regular expression that defines what the secret looks like (e.g., token format)

You can optionally specify additional match requirements (like required context keywords), but they’re not mandatory. Listing repositories is also not part of the required fields during pattern creation.

Code scanning merge requirements and severity thresholds are repository configuration controls and are therefore managed from the repository's Settings area. In GitHub's current interface, administrators can create a branch ruleset under Settings and configure Require code scanning results. They can then select the code scanning tool and specify alert thresholds, including which normal alerts or security-severity levels should prevent merging. The Security and quality tab is primarily where security findings are reviewed and triaged, while the Actions tab displays workflow execution information. The Pull Requests tab is used to review and merge proposed changes rather than configure repository-wide code scanning policy. Thus, although GitHub's implementation has evolved toward ruleset-based merge protection, the appropriate top-level location remains the repository's Settings tab.

To proactively address secret scanning:

Webhooks can be configured to listen for secret scanning events. This allows automation, logging, or alerting in real-time when secrets are detected.

Documenting secure development practices (like using environment variables or secret managers) helps reduce the likelihood of developers committing secrets in the first place.

Dismissal based on age is not a best practice without triage. SCIM deals with user provisioning, not scanning alerts.

Query suite definitions in CodeQL are stored using the .qls file extension. A query suite defines a collection of queries to be run during an analysis and allows for grouping them based on categories like language, security relevance, or custom filters.

In contrast:

.ql files are individual queries.

.qll files are libraries used by .ql queries.

.yml is used for workflows, not query suites.