Add GHAS questions for part of Domain 5 (#138)

content/questions/advanced_security/question-063.md

@@ -0,0 +1,13 @@
+---
+archetype: "questions"
+title: "Question 063"
+question: "CodeQL scanning supports:"
+draft: false
+---
+
+
+> https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql#about-codeql
+1. [x] Both compiled and interpreted languages
+1. [ ] Only compiled languages
+1. [ ] Only interpreted languages
+1. [ ] All programming languages

content/questions/advanced_security/question-064.md

@@ -0,0 +1,13 @@
+---
+archetype: "questions"
+title: "Question 064"
+question: "What are CodeQL queries used for?"
+draft: false
+---
+
+
+> https://codeql.github.com/docs/writing-codeql-queries/about-codeql-queries/
+1. [x] CodeQL queries can be run against a CodeQL database to identify patterns that may indicate coding errors or security vulnerabilities.
+1. [ ] CodeQL queries analyze your codebase and are used to create a CodeQL database.
+1. [ ] CodeQL queries are used for code review purposes in GitHub.
+1. [ ] CodeQL queries are text-based questions you can ask the CodeQL engine about your codebase.

content/questions/advanced_security/question-065.md

@@ -0,0 +1,13 @@
+---
+archetype: "questions"
+title: "Question 065"
+question: "What is QL?"
+draft: false
+---
+
+
+> https://codeql.github.com/docs/ql-language-reference/about-the-ql-language/
+1. [x] QL is a query language that underlies CodeQL
+1. [ ] QL stands for Quality Level and is a metric used by CodeQL
+1. [ ] QL is a similar product to CodeQL but is used for scanning text files instead of code
+1. [ ] QL is a npm package that is used by CodeQL to scan code

content/questions/advanced_security/question-066.md

@@ -0,0 +1,13 @@
+---
+archetype: "questions"
+title: "Question 066"
+question: "What is a CodeQL query suite?"
+draft: false
+---
+
+
+> https://docs.github.com/en/code-security/code-scanning/managing-your-code-scanning-configuration/codeql-query-suites#about-codeql-query-suites
+1. [x] CodeQL suite is a collections of CodeQL queries
+1. [ ] CodeQL suite is a collection of CodeQL databases
+1. [ ] CodeQL suite is a collection of CodeQL results
+1. [ ] CodeQL suite is a collection of CodeQL supported languages

content/questions/advanced_security/question-067.md

@@ -0,0 +1,14 @@
+---
+archetype: "questions"
+title: "Question 067"
+question: "What are the different types of CodeQL packs? (Choose three.)"
+draft: false
+---
+
+> https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs#about-codeql-packs
+- [x] Query packs
+- [x] Library packs
+- [x] Model packs
+- [ ] Code packs
+- [ ] Language packs
+- [ ] Vulnerability packs

content/questions/advanced_security/question-068.md

@@ -0,0 +1,14 @@
+---
+archetype: "questions"
+title: "Question 068"
+question: "What is a CodeQL query pack?"
+draft: false
+---
+
+
+> https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs#about-codeql-packs
+1. [x] It's a set of pre-compiled queries with all transitive dependencies such as libraries and models
+1. [ ] It's a library used by CodeQL queries
+1. [ ] It's a collection of CodeQL queries
+> That's a CodeQL query suite 
+1. [ ] It's a set of results that were generated in the process of analyzing a CodeQL database

content/questions/advanced_security/question-069.md

@@ -0,0 +1,13 @@
+---
+archetype: "questions"
+title: "Question 069"
+question: "What are the steps of CodeQL analysis workflow?"
+draft: false
+---
+
+
+> https://codeql.github.com/docs/codeql-overview/about-codeql/#codeql-analysis
+1. [x] Creating a CodeQL database -> Running CodeQL queries -> Interpreting the results
+1. [ ] Running CodeQL queries -> Creating a CodeQL database -> Interpreting the results
+1. [ ] Running CodeQL queries -> Interpreting the results
+1. [ ] Creating a CodeQL database -> Interpreting the results -> Running CodeQL queries

content/questions/advanced_security/question-070.md

@@ -0,0 +1,13 @@
+---
+archetype: "questions"
+title: "Question 070"
+question: "What is extraction in the context of CodeQL code analysis?"
+draft: false
+---
+
+
+> https://codeql.github.com/docs/codeql-overview/about-codeql/#database-creation
+1. [x] Extraction is the process of creating a relational representation of each source file in the codebase.
+1. [ ] Extraction is the action of running CodeQL queries against a CodeQL database and extracting the results.
+1. [ ] Extraction is the process of creating CodeQL queries specific to the codebase.
+1. [ ] Extraction is the process of exporting data from a CodeQL database.

content/questions/advanced_security/question-071.md

@@ -0,0 +1,12 @@
+---
+archetype: "questions"
+title: "Question 071"
+question: "Which of these statements are true regarding running CodeQL analysis on codebases with multiple programming languages? (Choose two.)"
+draft: false
+---
+
+> https://codeql.github.com/docs/codeql-overview/about-codeql/#database-creation
+- [x] CodeQL uses a different extractor for each programming language
+- [x] CodeQL creates separate databases for each programming language
+- [ ] CodeQL creates one database for all programming languages in the codebase, as long as they are supported by CodeQL
+- [ ] CodeQL database schema is the same for each programming language

content/questions/advanced_security/question-072.md

@@ -0,0 +1,16 @@
+---
+archetype: "questions"
+title: "Question 072"
+question: "What are the differences when running CodeQL database creation for compiled and interpreted languages? (Choose two.)"
+draft: false
+---
+
+
+
+> https://codeql.github.com/docs/codeql-overview/about-codeql/#database-creation
+- [x] For compiled languages, extraction works by monitoring the build process. All information is collected each time the compiler is invoked to process a source file.
+- [x] For interpreted languages, the extractor runs directly on the source code.
+- [ ] For interpreted languages, extraction works by monitoring the build process. All information is collected each time the interpeter is invoked to process a source file.
+- [ ] For compiled languages, the extractor runs directly on the source code.
+- [ ] For compiled languages, the extractor runs on the executable file.
+- [ ] For interpreted languages, the extractor runs on the executable file.