AZ-400 Question 276
Select 2Your development team maintains several GitHub repositories that rely on open-source libraries. You want to automate the detection of vulnerabilities and licensing issues in these dependencies so that your CI/CD pipeline can quickly respond to any potential risks. You decide to use Dependabot to scan and notify your team of critical updates. Which two actions should you take to automatically track and address vulnerabilities in these open-source libraries?
- A
Configure a .github/dependabot.yml file in each repository to manage dependency updates and define the update frequency.
- B
Enable Dependabot alerts and the dependency graph in the repository settings to monitor vulnerabilities and receive updates.
- C
Install the GitHub Advanced Security extension in Azure DevOps to override Dependabot notifications with a custom workflow.
- D
Set an Azure Policy to prevent pull requests from merging if any library triggers a Dependabot vulnerability alert.
Show answer and explanation
Correct answers: A, B
Explanation
Dependabot is configured through two main components: (1) a .github/dependabot.yml file that defines how and when to update dependencies and (2) the Dependabot alerts feature that leverages the project's dependency graph. These settings must be enabled in the GitHub repository for Dependabot to function fully. Refer to the GitHub Dependabot documentation (https://docs.github.com/en/code-security/dependabot) for details on configuring and automating vulnerability detection and dependency updates.
- A. Correct.
Correct. Dependabot relies on the .github/dependabot.yml file to determine which dependencies to scan, the update frequency, and other configuration parameters. This file is essential for setting up automated pull requests to fix vulnerable or outdated libraries.
- B. Correct.
Correct. Enabling Dependabot alerts and the dependency graph (via GitHub repository settings) is necessary to detect and notify you of vulnerabilities and licensing issues in the project's dependencies. Without enabling these features, Dependabot cannot properly track and report potential problems.
- C. Incorrect.
Incorrect. GitHub Advanced Security is a separate offering and does not replace the native Dependabot features. You don�t install GitHub Advanced Security in Azure DevOps to manage Dependabot notifications. This distractor reflects a misunderstanding about how GitHub� security features integrate with Azure DevOps.
- D. Incorrect.
Incorrect. Azure Policy governs resources and deployments within Azure, not merges in GitHub. Although you can create checks in GitHub to block merges when vulnerabilities exist, you can�t enforce that using an Azure Policy for Dependabot alerts.