AZ-400 Develop a security and compliance plan Practice Question
Exhibit
Refer to the exhibit.
```json
{
"alert": {
"title": "High severity vulnerability found in dependency",
"state": "open",
"severity": "critical",
"created_at": "2026-03-15T10:00:00Z",
"repository": {
"name": "my-app",
"visibility": "internal"
},
"security_advisory": {
"summary": "Remote code execution in lodash",
"severity": "critical",
"cvss": {
"score": 9.8
}
}
}
}
```You receive a GitHub Dependabot alert as shown. The repository 'my-app' is internal. What is the best immediate action to mitigate the risk?
⚠ Common exam trap
It's easy for candidates to confuse Dependabot alerts with secret scanning or think that changing repository visibility (forking) mitigates a dependency vulnerability, when the correct action is always to update the vulnerable package.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the lodash dependency to the latest patched version
The Dependabot alert indicates a known vulnerability in the lodash dependency. The best immediate action is to update lodash to the latest patched version, which directly resolves the security issue by applying the fix provided by the maintainers. This aligns with the principle of remediating vulnerabilities at the source rather than implementing workarounds.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dismiss the alert as it is a false positive
Why it's wrong here
Dismissing the alert as a false positive is incorrect because Dependabot alerts are generated from authoritative vulnerability databases, and the alert for lodash is legitimate and critical. Dismissing it leaves the vulnerable dependency in place, exposing the repository to known exploits.
- ✗
Create a private fork of the repository
Why it's wrong here
Creating a private fork of the repository does not fix the vulnerability because the fork will still contain the same vulnerable lodash version. The dependency needs to be patched in the source code, not copied to a new repository, and forking does not apply any security updates.
- ✗
Enable secret scanning on the repository
Why it's wrong here
Enabling secret scanning on the repository would detect exposed credentials and API keys, but it does not address dependency vulnerabilities like a vulnerable lodash version. Secret scanning is a complementary security feature, not a remediation for Dependabot alerts, so it would leave the vulnerability unfixed.
- ✓
Update the lodash dependency to the latest patched version
Why this is correct
Updating the lodash dependency to the latest patched version is the direct remediation, as the patched release resolves the specific vulnerability identified by the alert. This requires modifying the package manifest and lock file to reference a fixed version and then redeploying the application to ensure the vulnerable code is no longer in use.
Visual reference
Go deeper
Related to this question
Learn chapter
Source Control Strategy Design
Key term
Repository
A repository is a central storage location where software packages, code, or configuration files are kept, managed, and distributed for use by IT systems.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.