Integrating GitHub Advanced Security Findings into Defender for Cloud
Your organization uses Microsoft Defender for Cloud to monitor Azure resources. The compliance team needs to ensure that all Azure DevOps projects have their pipelines scanned for security issues before deployment. Which integration should you use?
Quick Answer
Enabling GitHub Advanced Security for Azure DevOps within Microsoft Defender for Cloud is the integration that centralizes this — it lets Defender ingest secret scanning, code scanning, and dependency scanning alerts from Azure DevOps repos and pipelines directly, giving the compliance team unified visibility across every project without a separate tool.
⚠ Common exam trap
A common mix-up: candidates confuse Azure Policy (which enforces compliance on Azure resources) with the ability to enforce pipeline scanning, but Azure Policy cannot directly control Azure DevOps pipeline behavior, whereas the Defender for Cloud integration with GitHub Advanced Security provides the required centralized monitoring and enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud.
Enabling GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud allows Defender for Cloud to ingest security alerts from Azure DevOps repositories and pipelines, including secret scanning, code scanning, and dependency scanning. This integration ensures that all Azure DevOps projects are monitored for security issues before deployment, meeting the compliance team's requirement for centralized visibility and enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure branch policies in Azure Repos to require a security scan.
Why it's wrong here
Branch policies can require status checks, but they don't inherently integrate with Defender for Cloud.
- ✓
Enable GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud.
Why this is correct
This integration provides code scanning and secret scanning for Azure DevOps pipelines and repos.
- ✗
Configure deployment gates in Azure Pipelines to require a security scan.
Why it's wrong here
Deployment gates can call external services, but they are not the primary integration for Defender for Cloud.
- ✗
Use Azure Policy to enforce scanning on Azure DevOps pipelines.
Why it's wrong here
Azure Policy applies to Azure resources, not Azure DevOps pipelines directly.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your DevOps team is using Microsoft Defender for Cloud to monitor Azure resources. Which of the following is a security recommendation that Defender for Cloud might provide?
easy- A.Allow all inbound traffic on port 22 for SSH
- ✓ B.Enable Transparent Data Encryption (TDE) on SQL databases
- C.Disable auditing on storage accounts to reduce overhead
- D.Configure web apps to use HTTP instead of HTTPS
Why B: Microsoft Defender for Cloud provides security recommendations based on best practices and compliance frameworks. Enabling Transparent Data Encryption (TDE) on SQL databases is a standard security recommendation because it encrypts data at rest, protecting against unauthorized access to the physical database files. This aligns with the 'Develop a security and compliance plan' domain, as TDE helps meet regulatory requirements like GDPR or HIPAA.
Variation 2. Your team uses Microsoft Defender for Cloud to monitor Azure resources. You need to ensure that all Azure DevOps pipelines are scanned for security misconfigurations before deployment. Which integration should you enable?
easy- A.Connect Azure DevOps to Microsoft Sentinel.
- ✓ B.Enable the 'Defender for DevOps' integration in Microsoft Defender for Cloud.
- C.Deploy Microsoft Intune policies to Azure DevOps agents.
- D.Configure Microsoft Purview to scan Azure DevOps repositories.
Why B: Microsoft Defender for Cloud includes a 'Defender for DevOps' integration that allows you to connect Azure DevOps environments and scan pipelines for security misconfigurations, such as Infrastructure as Code (IaC) template issues or exposed secrets, before deployment. This integration provides built-in security posture assessments and actionable recommendations directly within the Defender for Cloud dashboard, enabling shift-left security practices.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.