AZ-400 Question 267
Select 3You are a DevOps engineer at a company that maintains repositories in both GitHub and Azure DevOps. Your organization recently purchased GitHub Advanced Security licenses and wants to enable code scanning and secret scanning for all repositories. You discover that there is a GitHub Advanced Security extension for Azure DevOps in preview that can scan for vulnerable code and exposed secrets in Azure DevOps as well. Which of the following actions should you take to successfully implement GitHub Advanced Security across both GitHub and Azure DevOps? (Choose three.)
- A
Acquire GitHub Advanced Security licenses for all committers in both GitHub and Azure DevOps environments
- B
Install the GitHub Advanced Security extension in your Azure DevOps organization
- C
Configure secret scanning and code scanning for GitHub repositories through GitHub's Security settings
- D
Set up a separate on-premises instance of code scanning to feed results into GitHub Advanced Security
- E
Use Azure Policy to enforce GitHub Advanced Security on all Azure DevOps pipelines
Show answer and explanation
Correct answers: A, B, C
Explanation
To implement GitHub Advanced Security for both GitHub and Azure DevOps, you need the correct licensing for users and must enable the extension in Azure DevOps (in preview) to allow code scanning and secret scanning. On GitHub, you configure Advanced Security features per repository through the Security settings. Refer to Microsoft and GitHub documentation for details on (1) GitHub Advanced Security licensing (https://docs.github.com/en/enterprise-cloud@latest/github/getting-started-with-github-enterprise/about-github-advanced-security), (2) enabling code and secret scanning in GitHub (https://docs.github.com/en/code-security/code-scanning), and (3) installing the GitHub Advanced Security extension for Azure DevOps (https://learn.microsoft.com/en-us/azure/devops/marketplace/advanced-security).
- A. Correct.
CORRECT. GitHub Advanced Security is a per-committer license that applies to both GitHub and Azure DevOps if you use the preview extension. Each committer, whether contributing in GitHub or Azure DevOps, needs a license.
- B. Correct.
CORRECT. The GitHub Advanced Security extension for Azure DevOps (currently in preview) must be installed in your Azure DevOps organization to enable features such as code scanning and secret scanning in Azure DevOps repositories.
- C. Correct.
CORRECT. In GitHub, you enable code scanning (e.g., via CodeQL) and secret scanning by configuring the settings under the Security tab for each repository. This is essential to leverage all GitHub Advanced Security capabilities.
- D. Incorrect.
INCORRECT. You do not need an on-premises instance of code scanning for GitHub Advanced Security. GitHub Advanced Security supports both GitHub Actions and other CI/CD systems, but it does not require creating or maintaining your own on-premises code scanning instance.
- E. Incorrect.
INCORRECT. Azure Policy does not enforce GitHub Advanced Security scans. Instead, you enable Advanced Security features through the extension in Azure DevOps or by configuring GitHub repositories directly. Azure Policy is generally used for governing Azure resources, not GitHub Advanced Security.