AZ-400 Practice Question: Design and implement build and release pipelines
You are implementing a build pipeline for a .NET application that uses GitHub Advanced Security (GHAS) for code scanning. The pipeline must run CodeQL analysis on every pull request to the main branch. You have added the CodeQL task to the pipeline. However, the analysis results are not appearing in the 'Security' tab of the repository on GitHub. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume adding the CodeQL analysis task alone is sufficient, overlooking the mandatory SARIF upload step that bridges the analysis output to GitHub's security dashboard.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The pipeline is missing the 'Publish Security Analysis Logs' step to upload SARIF results to GitHub.
CodeQL analysis results are uploaded to GitHub as SARIF files. Without the 'Publish Security Analysis Logs' step (or the equivalent 'upload-sarif' action), the SARIF file generated by CodeQL is not sent to GitHub, so the findings never appear in the Security tab. The pipeline must explicitly include this step to complete the integration with GitHub Advanced Security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The pipeline is missing the 'Publish Security Analysis Logs' step to upload SARIF results to GitHub.
Why this is correct
In Azure DevOps, CodeQL results are produced as SARIF files, but they do not automatically appear in the GitHub Security tab. You must explicitly include the 'Publish Security Analysis Logs' task (or equivalent) to upload those SARIF logs to GitHub, which is what enables the findings to be displayed in the security alerts. Without this step, the analysis may run but the results are never surfaced.
- ✗
The GitHub repository is private, so security alerts are disabled.
Why it's wrong here
This is false because GitHub Advanced Security (GHAS) is fully supported on private repositories; in fact, private repos are the primary use case for security alerts. The free tier may limit features, but if the repo is private and GHAS is enabled, alerts are not disabled. The issue here is purely the missing upload step, not the repo visibility.
- ✗
The .NET project is not supported by CodeQL.
Why it's wrong here
CodeQL officially supports C, C++, C#, Java, JavaScript/TypeScript, Python, Go, and Ruby, so a .NET application (which is typically C#) is absolutely supported. The pipeline can use the CodeQL Initialize, Analyze, and Publish steps with a .NET project without any issue. Therefore, 'unsupported project type' is not the cause.
- ✗
CodeQL analysis is not supported on pull request triggers.
Why it's wrong here
CodeQL analysis fully supports pull request triggers in Azure DevOps, just as it does for branch builds. You can configure the CodeQL tasks to run on PRs to scan the diff and post results to the PR. The failure here is not about trigger type but about the absence of the SARIF upload step, which means results aren't delivered to GitHub.
Go deeper
Related to this question
Learn chapter
Implementing and Managing Source Control
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
CodeQL
CodeQL is a semantic code analysis engine used by developers to find security vulnerabilities in source code by treating code as data and querying it for potential flaws.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.