Preventing Leaked Secrets with Credential Scanner and Key Vault Migration
You are using GitHub Advanced Security. The security team wants to prevent developers from introducing code with high-severity vulnerabilities. What is the best way to enforce this?
Quick Answer
Enabling code scanning with a quality gate that fails pull requests on high-severity alerts is what actually blocks vulnerable code from merging — it runs CodeQL analysis directly at the PR gate, catching issues before they reach main, whereas Dependabot and secret scanning cover different risk categories (outdated dependencies, leaked credentials) and don't stop a PR on code-level vulnerabilities.
⚠ Common exam trap
It's easy for candidates to confuse Dependabot or secret scanning with code vulnerability prevention, but only code scanning with a quality gate directly blocks high-severity code vulnerabilities at the PR level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable code scanning and configure a quality gate to fail PRs with high-severity alerts
Enabling code scanning with a quality gate that fails pull requests (PRs) on high-severity alerts directly prevents vulnerable code from being merged. This enforces security policy at the PR merge point, using GitHub's CodeQL analysis to detect vulnerabilities before they reach the main branch. Dependabot and secret scanning address different risks (outdated dependencies and leaked secrets) and do not block code with high-severity vulnerabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Dependabot and require pull request reviews for dependency updates
Why it's wrong here
Dependabot raises pull requests for vulnerable dependencies and reviews gate their merge, but this only addresses known third-party package advisories. It is correct for supply-chain dependency hygiene, not for detecting high-severity flaws in the team's own committed source code.
- ✓
Enable code scanning and configure a quality gate to fail PRs with high-severity alerts
Why this is correct
Code scanning analyses pull requests and raises alerts; a branch protection rule or ruleset requiring the code scanning check to pass blocks merges while high-severity alerts remain. This enforces the gate before vulnerable code reaches the main branch.
- ✗
Enable push protection for all repositories
Why it's wrong here
Push protection blocks secrets from being pushed, not code containing high-severity vulnerabilities. It is the right control for preventing credential leakage at commit time; blocking vulnerable code requires code scanning with branch protection rules that fail the check.
- ✗
Enable secret scanning and block pushes with high-confidence secrets
Why it's wrong here
Secret scanning targets credentials and tokens, not code vulnerabilities, so it cannot block high-severity flaws. Code scanning with CodeQL analyses source for vulnerability patterns and, combined with branch protection, blocks merges. Secret scanning is correct when preventing hardcoded credentials from entering repositories.
Go deeper
Related to this question
Learn chapter
Implementing Security and Compliance in Pipelines
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
Key term
CodeQL
CodeQL is a semantic code analysis engine used by developers to find security vulnerabilities in source code by treating code as data and querying it for potential flaws.
About these practice questions
One of 696 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company uses GitHub Advanced Security. You need to ensure that all code in the main branch is free of high-severity secrets before deployment. What is the most efficient way to enforce this?
hard- A.Require manual review of all pull requests for secrets
- ✓ B.Enable secret scanning push protection
- C.Configure Dependabot to flag secrets in dependencies
- D.Enable code scanning alerts for secrets
Why B: Secret scanning push protection (option B) is the most efficient way to enforce that no high-severity secrets reach the main branch because it blocks the push at the Git level before the commit is accepted. This prevents secrets from ever entering the repository, eliminating the need for post-hoc detection or manual review. Other options either rely on reactive detection or do not address secrets in code.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.