Pass the Microsoft GitHub Administrator GH-500 Questions and answers with CertsForce

By default, secret scanning is enabled automatically for all public repositories . For private or internal repositories, secret scanning must be enabled manually unless configured at the organization or enterprise level.

This default behavior helps protect open-source projects without requiring additional configuration.

When a vulnerability is detected, GitHub shows a warning that includes a brief description of the vulnerability . This typically covers the name of the CVE (if available), a short summary of the issue, severity level, and potential impact. The message also links to additional advisory data from the GitHub Advisory Database.

This helps developers understand the context and urgency of the vulnerability before applying the fix.

CodeQL security queries are associated with Common Weakness Enumeration (CWE) classifications. CWE provides standardized categories for classes of software weaknesses, such as improper input validation, path traversal, or SQL injection. GitHub CodeQL query metadata and alert tags can contain CWE identifiers, and GitHub allows code scanning alerts to be filtered by CWE tags. CVEs identify specific publicly disclosed vulnerabilities rather than general weakness categories in source-code analysis. A GHSA identifies a GitHub Security Advisory, while VEX communicates whether a product is affected by a known vulnerability. For CodeQL findings, CWE is therefore the relevant classification system used to describe the type of weakness represented by an alert. GitHub's code scanning API also exposes CodeQL rules containing external/cwe/... tags.

In a workflow : GitHub Actions workflows are the most common place for CodeQL code scanning. The codeql-analysis.yml defines how the analysis runs and when it triggers.

In an external CI system : GitHub allows you to run CodeQL analysis outside of GitHub Actions. Once complete, the results can be uploaded using the upload-sarif action to make alerts visible in the repository.

You cannot run or trigger analysis from third-party repositories directly, and the Files changed tab in pull requests only shows diff — not analysis results.

When a CodeQL workflow uses a language matrix, the matrix explicitly defines which programming languages the workflow analyzes. GitHub states that CodeQL will analyze only the languages included in that matrix; adding or removing matrix entries therefore directly changes the languages scanned. The matrix also allows separate language-analysis jobs to run in parallel, so it does not inherently make analysis sequential. The languages input of the CodeQL init action commonly receives the current matrix.language value, but that describes how the matrix value is passed into CodeQL rather than the principal impact asked for here. The matrix also does not represent dependency exclusions. Consequently, the operational effect being tested is that CodeQL analysis is restricted to the languages explicitly included in the workflow's matrix.

When a public repository contains credentials that match known secret formats, GitHub will automatically notify the service provider that issued the secret. This process is known as "secret scanning partner notification" . The provider may then revoke the secret or contact the user directly.

GitHub does not publicly display the alert and does not send internal repository notifications for public detections.

Comprehensive and Detailed Explanation:

In private repositories, users with write access can fix code scanning alerts. They can do this by committing changes that address the issues identified by the code scanning tools. This level of access ensures that only trusted contributors can modify the code to resolve potential security vulnerabilities.​

GitHub Docs

Users with read or triage roles do not have the necessary permissions to make code changes, and the security manager role is primarily focused on managing security settings rather than directly modifying code.​

Comprehensive and Detailed Explanation:

A CodeQL database contains a representation of your codebase, including the build of the code and extracted data. This database is used to run CodeQL queries to analyze your code for potential vulnerabilities and errors.​

GitHub Docs

In a dependabot.yml configuration file, package-ecosystem is a required key . It defines the package manager being used in that update configuration (e.g., npm, pip, maven, etc.).

Without this key, Dependabot cannot determine how to analyze or update dependencies. Other keys like rebase-strategy or commit-message are optional and used for customizing behavior.

A security policy is defined by a SECURITY.md file in the root of your repository or .github/ directory. This file informs contributors and security researchers about how to responsibly report vulnerabilities. It improves your project’s transparency and ensures timely communication and mitigation of any reported issues.

Adding this file also enables a “Report a vulnerability” button in the repository’s Security tab.