AZ-400 - Develop a Security and Compliance Plan (13% of the exam) - Section 4.3

Automate security and compliance scanning, including dependency, code, secret, and licensing scanning with GitHub Advanced Security and Microsoft Defender for Cloud.

Automate security scanning in pipelines using GitHub Advanced Security features - CodeQL analysis, Dependabot alerts, and secret scanning - to catch vulnerabilities at commit time. Integrate Microsoft Defender for Cloud to extend compliance and licensing checks beyond the repository and cover deployed workloads.

GitHub Advanced SecurityMicrosoft Defender for CloudCodeQL analysisDependabot alertssecret scanning

Practice question for this objective

Free sampleDevelop a Security and Compliance Planhard

A platform team enables "GitHub Advanced Security" on a repository and wants three distinct automated scans running against every push: static analysis that traces untrusted input through the application code, detection of credentials committed anywhere in history, and alerts for open-source dependencies with newly disclosed vulnerabilities. Which two "GitHub Advanced Security" capabilities, combined with the dependency graph, deliver these scans? Select TWO.

ACode scanning with "CodeQL", which performs data-flow static analysis of the repository's own source and raises code scanning alerts for findings such as injection and path traversal. Correct
BBranch protection rules with a required linear history, which reject force pushes and therefore prevent any vulnerable code or leaked credential from reaching the default branch.
CSecret scanning, which inspects the contents of the repository for committed credentials and tokens and raises an alert when a recognised secret pattern is found. Correct
DMicrosoft Defender for Cloud agentless code scanning, which is the only way to obtain CodeQL data-flow results and dependency alerts inside the "GitHub" repository security tab.

Identify the GitHub Advanced Security scanning capabilities that provide static code analysis, secret detection, and dependency vulnerability alerts. GitHub Advanced Security packages distinct scans: CodeQL code scanning analyses first-party source through data-flow tracking, secret scanning detects committed credentials across history, and Dependabot uses the dependency graph for vulnerability alerts. Each addresses a separate class of finding rather than overlapping.

Why A is correct: Code scanning with CodeQL is the GitHub Advanced Security feature that statically analyses the team's own source via data-flow tracking and surfaces vulnerabilities as code scanning alerts.

Why B is wrong: Branch protection governs merge eligibility and history shape; it performs no static analysis, secret detection, or dependency scanning, so it is tempting as a control gate but is not a scanning capability.

Why C is correct: Secret scanning is the GitHub Advanced Security feature that detects committed credentials across the repository and history and raises secret scanning alerts, satisfying the credential-detection requirement.

Why D is wrong: Defender for Cloud aggregates DevOps findings into the Azure portal and is not a GitHub Advanced Security feature, and GitHub native code scanning and Dependabot already surface results in the repository security tab, so the exclusivity claim is wrong.

See more AZ-400 practice questions, answers explained.

Exam traps in Develop a Security and Compliance Plan

Answers that look right on this material and are not. Each one is a distractor from a different question in the AZ-400 bank for this domain.

It replaces GitHub Advanced Security entirely, because Defender for Cloud reruns CodeQL, secret scanning, and Dependabot itself and disables those native scans in the connected repositories.
Why it is wrong: Defender for Cloud aggregates and contextualises findings rather than replacing GitHub Advanced Security or disabling native scans, so the claim that it supplants and turns off those features is wrong despite sounding like consolidation.
A repository ruleset that requires a status check named secret-scan, so any push containing a credential fails the check and the branch update is rejected at the server.
Why it is wrong: Status checks gate pull request merges after a push is already on a branch; they do not block the push itself at commit time, so a secret would still reach the remote, making this tempting but ineffective for the stated point-of-commit requirement.
Configure Dependabot security updates so it analyses the application source for injection and traversal patterns and opens pull requests that rewrite the vulnerable code paths it discovers.
Why it is wrong: Dependabot only updates vulnerable third-party dependencies and never inspects first-party source for injection flaws; it is tempting because it raises security pull requests, but it cannot perform taint analysis on your own code.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.