Microsoft Updated GH-500 Exam Questions and Answers by cataleya

In a workflow : GitHub Actions workflows are the most common place for CodeQL code scanning. The codeql-analysis.yml defines how the analysis runs and when it triggers.

In an external CI system : GitHub allows you to run CodeQL analysis outside of GitHub Actions. Once complete, the results can be uploaded using the upload-sarif action to make alerts visible in the repository.

You cannot run or trigger analysis from third-party repositories directly, and the Files changed tab in pull requests only shows diff — not analysis results.

Comprehensive and Detailed Explanation:

When GitHub identifies a vulnerable dependency in a repository with Dependabot alerts enabled, it performs the following actions:​

Generates a Dependabot alert: The alert is displayed on the repository's Security tab, providing details about the vulnerability and affected dependency.​

Notifies repository maintainers: By default, GitHub notifies users with write, maintain, or admin permissions about new Dependabot alerts.​

GitHub Docs

These actions ensure that responsible parties are informed promptly to address the vulnerability.​

The security-extended query suite includes additional CodeQL queries that detect lower severity issues than those in the default security-and-quality suite.

It’s often used when projects want broader visibility into code hygiene and potential weak spots beyond critical vulnerabilities.

The other options listed are paths to language packs , not query suites themselves.

GitHub documents a size limit for the .github/secret_scanning.yml configuration file. If the file is larger than 1 MB, secret scanning ignores the entire configuration file. This file is used primarily to define paths-ignore entries for directories or files where matching secrets should automatically be excluded or alerts closed as ignored by configuration. There is also a separate limit on path exclusions: if paths-ignore contains more than 1,000 entries, GitHub processes only the first 1,000 directories rather than ignoring the complete configuration file. Therefore, the 1,000-entry condition has different behavior from exceeding the file-size limit. A 100 KB file remains below GitHub's documented threshold. Consequently, option B accurately identifies the condition that causes the entire secret_scanning.yml file to be ignored.