About This Flashcard Deck
This flashcard deck contains 10 cards covering key GHAS concepts for the GH-SECURITY exam. Test your GitHub Advanced Security knowledge. Use active recall by attempting to answer each question before revealing the answer.
Question
What is CodeQL?
Click to reveal answer
Answer
GitHub's semantic code analysis engine. Treats code as data, uses queries (QL language) to find vulnerabilities and code patterns.
Click to flip back
All GHAS Flashcards
Q: What is CodeQL?
A: GitHub's semantic code analysis engine. Treats code as data, uses queries (QL language) to find vulnerabilities and code patterns.
Q: What is push protection?
A: Blocks git push if it contains a detected secret. Prevents secrets from entering the repository. Part of secret scanning.
Q: What is the dependency graph?
A: Automatically maps all dependencies in a repository based on manifest files (package.json, requirements.txt, etc.).
Q: What is SARIF?
A: Static Analysis Results Interchange Format — standard JSON format for static analysis tool output. GitHub supports SARIF uploads.
Q: What is the difference between Dependabot alerts and security updates?
A: Alerts: notifications about vulnerabilities. Security updates: automatic PRs to fix vulnerable dependencies.
Q: What is a custom secret scanning pattern?
A: User-defined regex patterns to detect organization-specific secrets not covered by built-in patterns.
Q: What is the security overview?
A: Org-level dashboard showing code scanning, secret scanning, and Dependabot alert status across all repositories.
Q: What is dependency review?
A: A GitHub Actions workflow that checks PRs for newly introduced vulnerable dependencies and can block merge.
Q: What is an SBOM?
A: Software Bill of Materials — inventory of all components/dependencies in software. GitHub can export via dependency graph.
Q: How does CodeQL default setup work?
A: Automatically configures code scanning for supported languages. No workflow file needed. Uses GitHub-hosted analysis.
GitHub Flashcard Study Method
GitHub certifications test platform-specific knowledge that you can verify immediately. When reviewing these flashcards, keep a browser tab open to github.com and verify each concept in real time. If a card covers branch protection rules, navigate to a repository's settings and explore the options. This active learning approach turns passive memorisation into practical experience that sticks for the exam.