GH-500 - GitHub Security suites administration - Section 6.4

Enable and configure default or approved custom CodeQL workflows, and use APIs and automation for large-scale security configuration and governance.

Enable default or approved custom CodeQL workflows across an enterprise and use the GitHub REST API and GraphQL API to automate large-scale security configuration and governance tasks. Choose between REST and GraphQL based on the data shape required, such as bulk repository queries versus targeted mutations.

custom CodeQL workflowsREST APIGraphQL APIautomation at scale

Practice question for this objective

Free sampleGitHub Security suites administrationhard

An enterprise owner on GitHub Enterprise Cloud sets a security configuration as the enterprise default to be applied to newly created repositories across all member organisations. One member organisation has already set its own organisation-level default security configuration; another has none. After the enterprise default is in place, what determines which configuration a brand new repository created in each organisation starts with?

  • ABoth organisations' new repositories start with the enterprise default, because an enterprise default overrides any organisation default for repositories created after it is set.
  • BThe organisation with its own default keeps applying that organisation default to its new repositories, while the organisation with none has the enterprise default applied to its new repositories. Correct
  • CNew repositories in both organisations start with no configuration, because an enterprise default only takes effect once each organisation owner explicitly opts in to inherit it.
  • DNew repositories in both organisations receive the enterprise default and the organisation default merged together, with the stricter setting winning on each individual feature.
An enterprise default security configuration applies to new repositories only in organisations that have not already set their own default, which is preserved. The enterprise default for newly created repositories is applied per organisation only where that organisation has no default of its own, so existing organisation defaults remain authoritative for their new repositories rather than being overridden or merged.

Why A is wrong: This is tempting if one assumes enterprise always wins, but the enterprise default deliberately yields to an existing organisation default rather than overriding it for new repositories.

Why B is correct: Correct: an enterprise default for new repositories applies only to organisations that do not already have their own default, so the organisation with a default keeps using it and the one without inherits the enterprise default.

Why C is wrong: This invents an opt-in step; the enterprise default applies automatically to qualifying organisations, so new repositories are not left configurationless pending an opt-in.

Why D is wrong: This describes a per-feature merge that does not happen; a repository starts from a single default configuration, not a blended combination of enterprise and organisation defaults.

See more GH-500 practice questions, answers explained.

More in this domain

Back to all GitHub Security suites administration objectives, or the GH-500 cert hub.

Examworthy is not affiliated with or endorsed by GitHub. Original, blueprint-aligned practice material only.