AZ-500 Question 251
Select 2You manage a GitHub repository for an internal application and want to implement automated security scanning using Microsoft Defender for Cloud DevOps Security. Which two actions must you take to connect your GitHub repository and configure scanning in a secure manner?
- A
Enable GitHub Advanced Security at the repository level to automatically trigger Microsoft Defender for Cloud scans
- B
Install the Defender for Cloud GitHub App in your GitHub organization and grant it access to the relevant repositories
- C
In the Azure portal, open Defender for Cloud, navigate to DevOps Security, and connect your GitHub environment by granting the necessary permissions
- D
Deploy a local CodeQL environment and manually trigger scans for each code commit
Show answer and explanation
Correct answers: B, C
Explanation
To properly configure Microsoft Defender for Cloud DevOps Security with GitHub, you must link your GitHub organization from the Defender for Cloud DevOps blade in the Azure portal and install the Defender for Cloud GitHub App in your organization. That combination allows Defender for Cloud to automatically scan code for vulnerabilities and compliance issues. Refer to Microsoft documentation on 'Connect your code repositories to Microsoft Defender for Cloud' (https://learn.microsoft.com/azure/defender-for-cloud) for detailed, step-by-step instructions.
- A. Incorrect.
Option 1: Incorrect. Enabling GitHub Advanced Security provides GitHub-native security scanning features (e.g., code scanning, Dependabot), but it does not configure Microsoft Defender for Cloud DevOps Security. Defender for Cloud integration requires its own app and configuration steps.
- B. Correct.
Option 2: Correct. Installing the Microsoft Defender for Cloud GitHub App and granting repository-level permissions is necessary. This step provides Defender for Cloud with the ability to analyze code, detect vulnerabilities, and display findings in the GitHub workflow.
- C. Correct.
Option 3: Correct. You must configure the GitHub connection from the Azure portal under Defender for Cloud: DevOps Security. This involves authenticating with GitHub, specifying organization or repository access, and allowing Defender for Cloud to scan the selected codebases.
- D. Incorrect.
Option 4: Incorrect. While CodeQL scanning is one approach supported by GitHub, it is independent of Microsoft Defender for Cloud DevOps Security. Defender for Cloud does not require you to set up a local CodeQL environment or manually trigger scans.