A platform team enables "GitHub Advanced Security" on a repository and wants three distinct automated scans running against every push: static analysis that traces untrusted input through the application code, detection of credentials committed anywhere in history, and alerts for open-source dependencies with newly disclosed vulnerabilities. Which two "GitHub Advanced Security" capabilities, combined with the dependency graph, deliver these scans? Select TWO.
- ACode scanning with "CodeQL", which performs data-flow static analysis of the repository's own source and raises code scanning alerts for findings such as injection and path traversal. Correct
- BBranch protection rules with a required linear history, which reject force pushes and therefore prevent any vulnerable code or leaked credential from reaching the default branch.
- CSecret scanning, which inspects the contents of the repository for committed credentials and tokens and raises an alert when a recognised secret pattern is found. Correct
- DMicrosoft Defender for Cloud agentless code scanning, which is the only way to obtain CodeQL data-flow results and dependency alerts inside the "GitHub" repository security tab.
Why A is correct: Code scanning with CodeQL is the GitHub Advanced Security feature that statically analyses the team's own source via data-flow tracking and surfaces vulnerabilities as code scanning alerts.
Why B is wrong: Branch protection governs merge eligibility and history shape; it performs no static analysis, secret detection, or dependency scanning, so it is tempting as a control gate but is not a scanning capability.
Why C is correct: Secret scanning is the GitHub Advanced Security feature that detects committed credentials across the repository and history and raises secret scanning alerts, satisfying the credential-detection requirement.
Why D is wrong: Defender for Cloud aggregates DevOps findings into the Azure portal and is not a GitHub Advanced Security feature, and GitHub native code scanning and Dependabot already surface results in the repository security tab, so the exclusivity claim is wrong.