How is CodeQL different from other static analysis tools? A It removes insecure code automatically

Question

Options

• AIt allows querying of code semantics using a database-like language.
• BIt only works for open-source projects.
• CIt runs analysis only after a security breach.

• A
  6% (3)
• B
  93% (50)
• C
  2% (1)

Explanation

There appears to be an error in this question - the marked correct answer (B) is actually incorrect based on how CodeQL works.

Option A is the correct answer. CodeQL's defining characteristic is that it converts source code into a queryable database, then lets analysts write QL queries (similar to SQL) to detect vulnerabilities by reasoning about code semantics, data flow, and control flow. This is fundamentally different from traditional static analyzers that use pattern matching or rule-based scanning.

Why B is wrong: CodeQL works for both open-source and private/commercial projects. GitHub offers free CodeQL scanning for public repositories, but it is also available for private repositories via GitHub Advanced Security - so "only open-source" is false.

Why C is wrong: CodeQL is a static analysis tool, meaning it analyzes source code without executing it and runs before deployment, not after a breach. Post-breach analysis is incident response, not static analysis.

Memory tip: Think of CodeQL as "SQL for source code" - the QL in CodeQL literally stands for Query Language. If a question asks what makes CodeQL unique, the answer always points to its database model + query language approach.

Note for the exam: The answer key marking B as correct appears to be a mistake. If this is from an official exam, it may be worth flagging to your instructor - the industry-standard answer is A.

No community discussion yet for this question.