AZ-400 Question 269
Select 2You lead a DevOps team for a large enterprise using GitHub Advanced Security to scan code. The security department wants all GitHub code scanning alerts visible within Microsoft Defender for Cloud to better consolidate and manage security data. Which two actions should you take to integrate GitHub Advanced Security with Microsoft Defender for Cloud?
- A
- Configure a connection from your GitHub organization to Microsoft Defender for DevOps in the Environment settings of Microsoft Defender for Cloud.
- B
- Enable CodeQL analysis or other GitHub-supported code scanning for each repository, ensuring that advanced security features are active.
- C
- Manually export SARIF files from GitHub code scanning alerts and upload them to Azure Monitor logs for processing.
- D
- Create a custom Azure DevOps pipeline that mirrors the GitHub repository and forwards the code scanning reports to Microsoft Defender for Cloud.
- E
- Configure an application whitelist within GitHub, granting the Microsoft Defender for Cloud API read access to the scanning results.
Show answer and explanation
Correct answers: A, B
Explanation
To integrate GitHub Advanced Security scanning results into Microsoft Defender for Cloud, you must enable code scanning (such as CodeQL analysis) on each relevant repository and connect your GitHub organization via Defender for DevOps in Microsoft Defender for Cloud. This allows all findings from GitHub Advanced Security to flow into Microsoft Defender for Cloud for centralized reporting and analytics. For more details, refer to official Microsoft Docs on Defender for DevOps integration at https://learn.microsoft.com/azure/defender-for-cloud/defender-for-devops-introduction.
- A. Correct.
Option 1 is correct. You must connect your GitHub organization to Microsoft Defender for DevOps (a feature within Microsoft Defender for Cloud) so that code scanning alerts can flow from GitHub to your Defender for Cloud environment. This is configured under Environment settings in Microsoft Defender for Cloud.
- B. Correct.
Option 2 is correct. GitHub Advanced Security code scanning (e.g., CodeQL analysis) must be enabled on each repository to generate security alerts. If no code scanning or advanced security scanning is turned on, there will be no alerts to send to Microsoft Defender for Cloud.
- C. Incorrect.
Option 3 is incorrect. While SARIF is a common format for code scanning results, Microsoft Defender for Cloud integration does not require manual upload of these files to Azure Monitor logs. The integration is automated once you properly connect GitHub to Defender for DevOps.
- D. Incorrect.
Option 4 is incorrect. Instead of creating a separate Azure DevOps pipeline, Microsoft Defender for DevOps provides built-in connectivity directly to GitHub� Advanced Security. Maintaining two separate pipelines for the same repos is both unnecessary and more complex.
- E. Incorrect.
Option 5 is incorrect. There is no requirement to configure an application whitelist in GitHub specifically for Microsoft Defender for Cloud. The official integration uses OAuth or token-based permissions when connecting GitHub organizations to Defender for DevOps.