AZ-400 Question 266
Select 2Your organization uses GitHub Enterprise for several repositories and Azure DevOps for additional projects. Leadership has decided to standardize security scanning across both platforms using GitHub Advanced Security features like code scanning and secret scanning. They also want to avoid disrupting existing CI pipelines in Azure DevOps. Which two actions should you recommend to enable GitHub Advanced Security scanning across both GitHub and Azure DevOps?
- A
Enable GitHub Advanced Security for GitHub repositories by configuring code scanning and secret scanning in each repository� Security & Analysis settings or GitHub Actions workflows.
- B
Enable the GitHub Advanced Security for Azure DevOps (Preview) feature and link Azure DevOps repos to a GitHub Enterprise organization, ensuring code scanning and secret scanning can be applied.
- C
Disable continuous integration pipelines in Azure DevOps to remove potential conflicts with GitHub Advanced Security scanning policies.
- D
Require that all Azure Repos repositories be migrated to GitHub so that GitHub Advanced Security tools can be used exclusively on GitHub Actions.
Show answer and explanation
Correct answers: A, B
Explanation
GitHub Advanced Security provides features like code scanning and secret scanning for GitHub repositories. With the GitHub Advanced Security for Azure DevOps (Preview), teams can enable similar scanning in Azure Repos without forcing migrations or pipeline disruption. For GitHub repositories, you typically enable code scanning by creating a workflow file or selecting the default CodeQL or third-party configuration in the Security & Analysis settings, while for Azure DevOps, you link your Azure Repos to a GitHub Advanced Security-enabled organization. More details can be found in the official GitHub documentation on Advanced Security and the GitHub Advanced Security for Azure DevOps preview.
- A. Correct.
Correct. GitHub Advanced Security must first be enabled in each GitHub repository (or at the organization level) to use code scanning and secret scanning. Configuring these settings or adding the relevant workflows is a standard approach for repositories on GitHub.
- B. Correct.
Correct. GitHub Advanced Security offers a Preview feature that integrates with Azure DevOps, allowing code scanning and secret scanning for Azure Repos without requiring a complete migration to GitHub. This reduces disruption to existing Azure DevOps pipelines.
- C. Incorrect.
Incorrect. You do not need to disable existing CI pipelines in Azure DevOps. The intent is to complement them with GitHub Advanced Security scanning, not replace them entirely.
- D. Incorrect.
Incorrect. While migrating everything to GitHub is an option, it is not strictly required. GitHub Advanced Security (Preview) for Azure DevOps exists so teams can keep their repos in Azure DevOps and still benefit from the security features.