What is the best method to ensure all new code is scanned for vulnerabilities?

The correct answer is B. Configure code scanning. Configuring code scanning (B) is the best method to ensure all new code is automatically analyzed for vulnerabilities. Code scanning integrates into the pull request workflow via GitHub Actions (using tools like CodeQL), scanning every code change before it is merged. Adding an…

Configure and use Code Scanning with CodeQL

Question

Options

AAdd the extended suite.
BConfigure code scanning.
CSet up a security policy.
DConfigure code owners.

How the community answered

(39 responses)

A
5% (2)
B
90% (35)
C
3% (1)
D
3% (1)

Explanation

Configuring code scanning (B) is the best method to ensure all new code is automatically analyzed for vulnerabilities. Code scanning integrates into the pull request workflow via GitHub Actions (using tools like CodeQL), scanning every code change before it is merged. Adding an extended query suite (A) enhances code scanning coverage but is a secondary configuration step, not the foundational setup. A security policy (C) documents reporting procedures but does not scan code. Code owners (D) manage review assignments, not vulnerability detection.

Topics

#Code scanning#Vulnerability scanning#New code security#GHAS

Community Discussion

No community discussion yet for this question.

Full GH-500 Practice