AZ-400 Question 274
Single answerYou are developing a microservices application that relies heavily on open-source libraries. Your project is hosted in a private GitHub repository, and you want to automate the detection of licensing issues, vulnerabilities, and dependency version updates. Additionally, you need any discovered issues to surface as pull requests for quick remediation. Which approach should you recommend to meet these requirements?
- A
Enable Dependabot alerts and configure Dependabot to automatically raise pull requests when it detects vulnerabilities or outdated versions.
- B
Use CodeQL analysis as part of GitHub Actions to monitor licenses and open pull requests for version upgrades.
- C
Set up Azure DevOps Pipelines to scan your node_modules folder manually and halt the build if any vulnerable library is used.
- D
Rely on npm audit in the CI pipeline to post issues directly into your GitHub repository's issue tracker.
Show answer and explanation
Correct answer: A
Explanation
For projects hosted in GitHub, Dependabot provides a straightforward way to analyze open-source dependencies for vulnerabilities, licenses, and outdated versions. Once enabled, Dependabot alerts can automatically create pull requests, helping teams track, review, and merge fixes with minimal overhead. Refer to GitHub's Dependabot documentation for setup details and recommended best practices (https://docs.github.com/code-security/dependabot).
- A. Correct.
Correct. Dependabot alerts can automatically detect vulnerabilities, licensing issues, and outdated versions in your GitHub repository. By enabling Dependabot and configuring it to raise pull requests, you ensure that any necessary updates are surfaced quickly and integrated into your CI build process.
- B. Incorrect.
Incorrect. CodeQL performs advanced code scanning and security analysis but does not directly handle licensing or create automated pull requests for outdated dependencies. It is complementary to Dependabot but does not natively provide the same dependency-management capabilities.
- C. Incorrect.
Incorrect. Scanning node_modules manually in each pipeline is cumbersome and does not provide proactive pull requests or automatic remediation. This approach may also miss licensing issues that Dependabot can detect automatically.
- D. Incorrect.
Incorrect. While npm audit can detect known vulnerabilities, it does not track licensing issues or automatically generate pull requests for version upgrades. It is more limited compared to Dependabot� automated alerts and remediation features.