Question 360 of 823
Preventing Leaked Secrets with Credential Scanner and Key Vault Migration
You are using GitHub Advanced Security. The security team wants to prevent developers from introducing code with high-severity vulnerabilities. What is the best way to enforce this?
Quick Answer
Enabling code scanning with a quality gate that fails pull requests on high-severity alerts is what actually blocks vulnerable code from merging — it runs CodeQL analysis directly at the PR gate, catching issues before they reach main, whereas Dependabot and secret scanning cover different risk categories (outdated dependencies, leaked credentials) and don't stop a PR on code-level vulnerabilities.
⚠ Common exam trap
It's easy for candidates to confuse Dependabot or secret scanning with code vulnerability prevention, but only code scanning with a quality gate directly blocks high-severity code vulnerabilities at the PR level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable code scanning and configure a quality gate to fail PRs with high-severity alerts
Enabling code scanning with a quality gate that fails pull requests (PRs) on high-severity alerts directly prevents vulnerable code from being merged. This enforces security policy at the PR merge point, using GitHub's CodeQL analysis to detect vulnerabilities before they reach the main branch. Dependabot and secret scanning address different risks (outdated dependencies and leaked secrets) and do not block code with high-severity vulnerabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Dependabot and require pull request reviews for dependency updates
Why it's wrong here
Dependabot handles dependencies, not code vulnerabilities.
- ✓
Enable code scanning and configure a quality gate to fail PRs with high-severity alerts
Why this is correct
This blocks PRs with high-severity code vulnerabilities.
- ✗
Enable push protection for all repositories
Why it's wrong here
Push protection is for secrets.
- ✗
Enable secret scanning and block pushes with high-confidence secrets
Why it's wrong here
Secret scanning blocks secrets, not code vulnerabilities.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company uses GitHub Advanced Security. You need to ensure that all code in the main branch is free of high-severity secrets before deployment. What is the most efficient way to enforce this?
hard- A.Require manual review of all pull requests for secrets
- ✓ B.Enable secret scanning push protection
- C.Configure Dependabot to flag secrets in dependencies
- D.Enable code scanning alerts for secrets
Why B: Secret scanning push protection (option B) is the most efficient way to enforce that no high-severity secrets reach the main branch because it blocks the push at the Git level before the commit is accepted. This prevents secrets from ever entering the repository, eliminating the need for post-hoc detection or manual review. Other options either rely on reactive detection or do not address secrets in code.
Last reviewed: Jul 4, 2026
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.