AZ-400 Question 275
Select 2You maintain a .NET project in a private GitHub repository that relies heavily on both internal and third-party open-source NuGet packages. Your team wants to automatically track vulnerabilities, license compliance issues, and new version releases by using Dependabot. You enable Dependabot alerts in the repository� Security settings but notice that no pull requests or alerts are generated for critical dependencies. Which two actions should you take so that Dependabot can effectively scan and update your .NET dependencies?
- A
Configure a valid dependabot.yml file under the .github directory that specifies "nuget" as the package-ecosystem and points to the correct project path.
- B
Enable GitHub Advanced Security in order for Dependabot to scan and update all your NuGet dependencies automatically.
- C
Create a private NuGet feed and host the dependencies there so that Dependabot can identify and patch vulnerabilities.
- D
Set Dependabot security updates to 'Enable all' in the repository� Security settings, ensuring it can automatically open pull requests for outdated or vulnerable packages.
Show answer and explanation
Correct answers: A, D
Explanation
To automatically analyze and update open-source dependencies using Dependabot in a .NET project, you must ensure that (1) you have a properly configured dependabot.yml file that specifies nuget as the package-ecosystem in the relevant directory and (2) Dependabot security updates are enabled. Subscribing to GitHub Advanced Security is not mandatory for basic Dependabot vulnerability scanning and pull request updates, and simply hosting packages in a private feed is not sufficient if the configuration file and security settings are not correctly set. For more details, refer to GitHub� Dependabot documentation: https://docs.github.com/en/code-security/dependabot.
- A. Correct.
Correct. For Dependabot to analyze and update dependencies, you must provide a dependabot.yml configuration file (commonly placed in .github/dependabot.yml). This file tells Dependabot which ecosystem (e.g., nuget) to check, which directories to scan, and how often to check for updates.
- B. Incorrect.
Incorrect. GitHub Advanced Security (which includes features like CodeQL) is not strictly required for Dependabot to scan and update dependencies. Dependabot alerts and updates are available for private repositories without needing GitHub Advanced Security, although advanced security features can provide additional benefits.
- C. Incorrect.
Incorrect. Using a private NuGet feed can be necessary for certain internal packages, but it is not a requirement for Dependabot to detect vulnerabilities on commonly used public NuGet packages. Dependabot can scan public or private feeds as long as the configuration is specified correctly in the dependabot.yml file, but simply moving everything to a private feed is not the primary missing step to enable vulnerability scanning.
- D. Correct.
Correct. Even though you enabled Dependabot alerts, you must also ensure that Dependabot security updates are actually turned on in the repository� settings. This setting allows Dependabot to open pull requests that address vulnerabilities or outdated packages once it identifies issues.