AZ-400 Question 265
Select 2You work for a company that stores some code in GitHub and other code in Azure DevOps. Your team recently purchased a GitHub Advanced Security license and wants to unify code scanning and secret scanning across both platforms. You need to ensure that GitHub Advanced Security features (including code scanning and secret scanning) are fully enabled for all repositories. Which two actions should you perform to meet this requirement?
- A
Enable GitHub Advanced Security features at the repository level for GitHub repos through each repository� Security & Analysis settings.
- B
Install a built-in GitHub Advanced Security task in Azure DevOps and reference it directly in your YAML pipeline to scan Azure Repos code.
- C
Mirror the Azure DevOps repository in a new GitHub repository and enable code scanning via GitHub Advanced Security in the mirrored repo.
- D
Grant all members owner-level access in GitHub so that advanced security scans run automatically without further configuration.
- E
Rely on GitHub organization-level policies alone, which automatically apply code scanning checks to all external repositories, including Azure Repos.
Show answer and explanation
Correct answers: A, C
Explanation
To use GitHub Advanced Security features (such as code scanning and secret scanning) on code stored in GitHub, you must enable these features in each GitHub repository� settings or through applicable organization policies. For Azure DevOps repositories, GitHub Advanced Security is not natively available. A typical workaround is to mirror the Azure DevOps project in a GitHub repository so that GitHub� advanced security scans can run on that mirrored copy of the code. More details can be found in GitHub� documentation on enabling Advanced Security and in best practices for migrating or mirroring repositories to GitHub.
- A. Correct.
Correct. For GitHub repositories, you must enable code scanning and secret scanning in the Security & Analysis settings of each repository (or via organization policies). This step ensures that GitHub Advanced Security features are active on GitHub repos.
- B. Incorrect.
Incorrect. There is no built-in GitHub Advanced Security task natively available in Azure DevOps pipelines. While you can integrate or mirror your Azure DevOps code into GitHub, you cannot simply install a �built-in task� in Azure DevOps to run GitHub� Advanced Security scans.
- C. Correct.
Correct. If you want GitHub Advanced Security to analyze code that resides in Azure DevOps, a common practice is to mirror that repository within GitHub. Once mirrored, you can enable code scanning and secret scanning features on the GitHub side to leverage GitHub Advanced Security.
- D. Incorrect.
Incorrect. Granting owner-level or admin-level access to all team members is neither necessary nor recommended purely for enabling advanced security scans. Least-privileged access is a best practice, and GitHub advanced security features do not require broad admin permissions to function.
- E. Incorrect.
Incorrect. GitHub Advanced Security organization-level settings do not automatically apply to external hosts like Azure DevOps. Organization-level policies can enforce scanning on GitHub� own repositories but cannot force scanning on code stored in Azure DevOps unless the code is replicated in GitHub.