Discuss Microsoft GH-500 Exam Topic 3 Question 16

-- [Configure GitHub Advanced Security Tools in GitHub Enterprise]

What step is required to run a SARIF-compatible (Static Analysis Results Interchange Format) tool on GitHub Actions?

AUpdate the workflow to include a final step that uploads the results.

BBy default, the CodeQL runner automatically uploads results to GitHub on completion.

CThe CodeQL action uploads the SARIF file automatically when it completes analysis.

DUse the CLI to upload results to GitHub.

Suggested Answer: A

When using a SARIF-compatible tool within GitHub Actions, it's necessary to explicitly add a step in your workflow to upload the analysis results. This is typically done using the upload-sarif action, which takes the SARIF file generated by your tool and uploads it to GitHub for processing and display in the Security tab. Without this step, the results won't be available in GitHub's code scanning interface.

Get Premium GH-500 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

17 comments · newest first

Skye 1 month ago

I still think D has its place in certain workflows.

Twanna 1 month ago

I agree with Marget. C is the best choice for this.

Marget 1 month ago

True, but C is more specific to SARIF files.

Micaela 2 months ago

But B is simpler, right? Less hassle.

Skye 2 months ago

I lean towards D. Using the CLI could be necessary sometimes.

Twanna 2 months ago

A seems right too. We might need to add a final step.

Marget 2 months ago

I feel like it's C. The action handles it automatically.

Micaela 2 months ago

I think it's B. CodeQL does it by default.

Tawna 3 months ago

Totally agree with A), it’s the only way to ensure results are uploaded!

Eladia 3 months ago

Wait, can you really use the CLI for this?

Pura 3 months ago

C) sounds familiar, but I’m not sure it’s the answer here.

Thaddeus 3 months ago

I thought B) was correct, but I guess it's A).

Yuette 3 months ago

A) is the right choice! You need that final step.

Oliva 3 months ago

I’m leaning towards B because I recall that the CodeQL runner does some automatic uploads, but I’m not completely confident.

Larue 4 months ago

I feel like I saw a question similar to this in practice, and it mentioned the CLI. Could it be D?

Sherly 4 months ago

I remember something about the CodeQL action, so maybe it's C? It seems like it would make sense for it to handle that automatically.

German 4 months ago

I think the answer might be A, but I'm not entirely sure if the workflow needs that final step for SARIF.

Microsoft GH-500 Exam - Topic 3 Question 16 Discussion