Three GitHub Advanced Security Features Worth Turning On
Your organization is adopting GitHub Advanced Security. Which THREE features should you enable to improve security?
Quick Answer
Dependabot alerts and security updates flag vulnerable dependencies automatically, secret scanning catches exposed credentials before or after they're committed, and code scanning (CodeQL) analyzes source for known vulnerability patterns — together these three GitHub Advanced Security features cover the dependency, credential, and code-level risk surfaces an organization typically needs to close first.
⚠ Common exam trap
It's easy for candidates to confuse standard GitHub features (like branch protection rules) with GitHub Advanced Security features, or assume that any security-related setting (e.g., GitHub Pages with HTTPS) qualifies as an Advanced Security improvement, when only secret scanning, Dependabot alerts/updates, and code scanning (CodeQL) are the three core Advanced Security capabilities tested on the AZ-400.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secret scanning
Secret scanning (Option C) is a GitHub Advanced Security feature that automatically detects exposed secrets (e.g., API keys, tokens, private keys) in repositories by matching against known patterns and partner-defined signatures. It helps prevent credential leaks from reaching production or being exploited, directly improving the security posture of your codebase.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
GitHub Pages
Why it's wrong here
GitHub Pages is for hosting websites.
- ✗
Branch protection rules
Why it's wrong here
Branch protection rules are not part of Advanced Security.
- ✓
Secret scanning
Why this is correct
Secret scanning detects credentials.
- ✓
Dependabot alerts and security updates
Why this is correct
Dependabot alerts manage vulnerable dependencies.
- ✓
Code scanning (CodeQL)
Why this is correct
Code scanning finds vulnerabilities in code.
Go deeper
Related to this question
Learn chapter
Implementing Deployment Patterns and Strategies
Key term
GitHub Advanced Security
GitHub Advanced Security is a suite of security tools integrated into GitHub that helps developers find and fix vulnerabilities, secrets, and code quality issues directly in their repositories.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team uses GitHub and wants to automatically detect exposed credentials in code. Which GitHub feature should you enable?
easy- A.Code scanning.
- B.Dependabot.
- ✓ C.Secret scanning.
- D.GitHub Actions.
Why C: Secret scanning is the correct GitHub feature because it is specifically designed to automatically detect exposed credentials, tokens, and other secrets in code repositories. It scans for known patterns of sensitive data, such as AWS keys, GitHub tokens, and private keys, and alerts repository administrators when a match is found. This directly addresses the requirement to detect exposed credentials without needing custom workflows or additional configuration.
Variation 2. Your team uses GitHub and wants to automatically detect exposed credentials in code. Which GitHub feature should you enable?
easy- A.Dependabot alerts
- B.GitHub Copilot
- C.Code scanning
- ✓ D.Secret scanning
Why D: Secret scanning is the correct answer because it is the GitHub feature specifically designed to automatically detect exposed credentials, such as API keys, tokens, and passwords, in code repositories. It scans for known patterns of secrets and can alert both the repository owner and the partner service (e.g., AWS, Azure) to revoke the compromised credential. This directly addresses the requirement to automatically detect exposed credentials in code.
Variation 3. Your team uses GitHub and wants to automatically detect and block secrets pushed to repositories. Which GitHub feature should you enable?
easy- A.Dependabot alerts
- B.Code scanning
- ✓ C.Push protection
- D.Secret scanning
Why C: Push protection is the GitHub feature that automatically detects known types of secrets in pushed content and blocks the push, preventing exposure. Secret scanning, on the other hand, scans for secrets and alerts after they exist in the repository but does not block the push unless push protection is enabled. Since the requirement is to 'automatically detect and block secrets pushed', the feature to enable is Push protection.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.