AZ-400 - Develop a Security and Compliance Plan - Section 4.3

Automate security and compliance scanning, including dependency, code, secret, and licensing scanning with GitHub Advanced Security and Microsoft Defender for Cloud.

Automate security scanning in pipelines using GitHub Advanced Security features - CodeQL analysis, Dependabot alerts, and secret scanning - to catch vulnerabilities at commit time. Integrate Microsoft Defender for Cloud to extend compliance and licensing checks beyond the repository and cover deployed workloads.

GitHub Advanced SecurityMicrosoft Defender for CloudCodeQL analysisDependabot alertssecret scanning

Practice question for this objective

Free sampleDevelop a Security and Compliance Planhard

A platform team enables "GitHub Advanced Security" on a repository and wants three distinct automated scans running against every push: static analysis that traces untrusted input through the application code, detection of credentials committed anywhere in history, and alerts for open-source dependencies with newly disclosed vulnerabilities. Which two "GitHub Advanced Security" capabilities, combined with the dependency graph, deliver these scans? Select TWO.

  • ACode scanning with "CodeQL", which performs data-flow static analysis of the repository's own source and raises code scanning alerts for findings such as injection and path traversal. Correct
  • BBranch protection rules with a required linear history, which reject force pushes and therefore prevent any vulnerable code or leaked credential from reaching the default branch.
  • CSecret scanning, which inspects the contents of the repository for committed credentials and tokens and raises an alert when a recognised secret pattern is found. Correct
  • DMicrosoft Defender for Cloud agentless code scanning, which is the only way to obtain CodeQL data-flow results and dependency alerts inside the "GitHub" repository security tab.
Identify the GitHub Advanced Security scanning capabilities that provide static code analysis, secret detection, and dependency vulnerability alerts. GitHub Advanced Security packages distinct scans: CodeQL code scanning analyses first-party source through data-flow tracking, secret scanning detects committed credentials across history, and Dependabot uses the dependency graph for vulnerability alerts. Each addresses a separate class of finding rather than overlapping.

Why A is correct: Code scanning with CodeQL is the GitHub Advanced Security feature that statically analyses the team's own source via data-flow tracking and surfaces vulnerabilities as code scanning alerts.

Why B is wrong: Branch protection governs merge eligibility and history shape; it performs no static analysis, secret detection, or dependency scanning, so it is tempting as a control gate but is not a scanning capability.

Why C is correct: Secret scanning is the GitHub Advanced Security feature that detects committed credentials across the repository and history and raises secret scanning alerts, satisfying the credential-detection requirement.

Why D is wrong: Defender for Cloud aggregates DevOps findings into the Azure portal and is not a GitHub Advanced Security feature, and GitHub native code scanning and Dependabot already surface results in the repository security tab, so the exclusivity claim is wrong.

See more AZ-400 practice questions, answers explained.

More in this domain

Back to all Develop a Security and Compliance Plan objectives, or the AZ-400 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.