Courseiva
← AZ-400
Full test
Design and implement build and release pipelines →easyMultiple ChoiceObjective-mapped

AZ-400 Practice Question: Design and implement build and release pipelines

You need to automatically run a security scan on every pull request in GitHub. The scan should block the PR if critical vulnerabilities are found. Which GitHub feature should you use?

⚠ Common exam trap

Test-takers frequently confuse Dependabot (which handles dependency updates) or branch protection rules (which enforce checks) with the actual scanning tool, forgetting that Code Scanning with CodeQL is the specific feature that performs the security analysis and can block PRs based on vulnerability severity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

GitHub Code Scanning with a CodeQL workflow

GitHub Code Scanning with a CodeQL workflow is the correct choice because it allows you to define a custom security analysis that runs on every pull request. By configuring the workflow to fail on critical-severity alerts, the pull request is automatically blocked, preventing vulnerable code from being merged. This integrates directly with GitHub's checks API to enforce the scan result as a required status check.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    GitHub Code Scanning with a CodeQL workflow

    Why this is correct

    GitHub Code Scanning with a CodeQL workflow is the correct answer because CodeQL performs semantic analysis of your source code, identifying vulnerabilities such as SQL injection, cross-site scripting, and path traversal. When configured in a GitHub Actions workflow with an `on: pull_request` trigger, CodeQL runs on every pull request and surfaces results directly as a check run in the PR's checks interface. These check runs can then be required by branch protection rules, meaning a pull request is blocked from merging until CodeQL reports no security issues, providing a true automated code-security gate.

  • ✗

    Dependabot version updates

    Why it's wrong here

    Dependabot version updates automatically create pull requests to update vulnerable or outdated dependencies, but they do not scan each pull request for code vulnerabilities and cannot block merging based on a security scan result; they are a dependency maintenance feature, not a PR-scanning gate.

  • ✗

    Secret scanning

    Why it's wrong here

    Secret scanning is designed to detect exposed credentials, tokens, or API keys in the repository, not to analyze source code for security vulnerabilities; therefore, it does not provide the code-level security scan required on every pull request and cannot block merging based on code flaws.

  • ✗

    Branch protection rules with required status checks

    Why it's wrong here

    Branch protection rules with required status checks can block a pull request from merging until a specified status check passes, but they do not perform any security scanning themselves; they only enforce the presence and result of a check that must be supplied by a tool such as GitHub Code Scanning with CodeQL.

About these practice questions

One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.