AZ-400 Question 270
Select 2You are a DevOps engineer for a company using GitHub Advanced Security for code scanning and Azure for deployment. Your organization wants insights from GitHub Advanced Security vulnerability findings to appear in Microsoft Defender for Cloud for a unified security posture. Which two actions should you take to properly integrate GitHub Advanced Security with Microsoft Defender for Cloud?
- A
A. Enable Dependabot alerts in GitHub repositories and configure an Azure webhook to forward alerts to Microsoft Defender for Cloud
- B
B. In GitHub, enable code scanning with GitHub Advanced Security and grant the Defender for Cloud app Read permissions on your repositories
- C
C. Create an Azure DevOps Pipeline to query GitHub security alerts and push them to Microsoft Defender for Cloud using Azure CLI commands
- D
D. Set up the GitHub connector within Microsoft Defender for Cloud by providing GitHub organization details and validating permissions
- E
E. Configure GitHub to upload findings into a Storage account, then import these findings manually into Defender for Cloud
Show answer and explanation
Correct answers: B, D
Explanation
To integrate GitHub Advanced Security with Microsoft Defender for Cloud, you must enable Advanced Security features (for example, code scanning in GitHub) and grant Microsoft Defender for Cloud the necessary permissions. Then, configure the GitHub connector in the Defender for Cloud portal. This approach ensures that vulnerabilities discovered by GitHub Advanced Security appear in Defender for Cloud. For more details, see the official Microsoft Defender for Cloud documentation at https://learn.microsoft.com/azure/defender-for-cloud.
- A. Incorrect.
A. Incorrect: Simply enabling Dependabot alerts and setting up a webhook does not establish a direct, supported integration with Microsoft Defender for Cloud. Dependabot is useful for dependency updates, but it doesn't automatically feed findings to Defender for Cloud.
- B. Correct.
B. Correct: Enabling code scanning and granting the Defender for Cloud (GitHub) app the necessary repository permissions ensures GitHub Advanced Security findings can be read and shared with Microsoft Defender for Cloud.
- C. Incorrect.
C. Incorrect: Manually creating an Azure DevOps Pipeline to push alerts into Defender for Cloud is not a standard approach. Microsoft provides direct integration options without requiring a custom pipeline for alert forwarding.
- D. Correct.
D. Correct: Microsoft Defender for Cloud offers a GitHub connector feature that allows you to connect your GitHub organization or repositories, authenticate, and validate permissions so that GitHub Advanced Security alerts flow into Defender for Cloud.
- E. Incorrect.
E. Incorrect: Uploading findings to a storage account and importing results into Defender for Cloud is not an official or automated integration path. Defender for Cloud relies on a data connector and permissions model with GitHub, not manual imports.