AZ-400 Develop a security and compliance plan Practice Question
Your company uses GitHub Advanced Security. You need to ensure that all code in the main branch is free of high-severity secrets before deployment. What is the most efficient way to enforce this?
⚠ Common exam trap
Candidates often confuse 'secret scanning alerts' (which detect secrets after they are committed) with 'push protection' (which blocks secrets before they are committed), leading them to choose option D instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable secret scanning push protection
Secret scanning push protection (option B) is the most efficient way to enforce that no high-severity secrets reach the main branch because it blocks the push at the Git level before the commit is accepted. This prevents secrets from ever entering the repository, eliminating the need for post-hoc detection or manual review. Other options either rely on reactive detection or do not address secrets in code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require manual review of all pull requests for secrets
Why it's wrong here
Requiring manual review of all pull requests for secrets is error-prone and does not scale; human reviewers can miss subtle secrets in large diffs, and this process only occurs after changes are pushed, so secrets can already exist in the repository history. It does not provide a deterministic, automated gate at push time.
- ✓
Enable secret scanning push protection
Why this is correct
Secret scanning push protection uses a pre-receive hook to detect supported secret patterns (e.g., GitHub tokens, AWS access keys) in commits before they are pushed, blocking the push and preventing the secret from ever reaching the remote repository. This makes it an effective, automated control for keeping secrets out of git history—even before a PR is opened.
- ✗
Configure Dependabot to flag secrets in dependencies
Why it's wrong here
Dependabot is specifically designed to track and update dependencies based on known vulnerability databases; it does not scan repository contents for secrets or recognize secret patterns in your own code. Therefore, configuring Dependabot would have no effect on preventing secret leaks.
- ✗
Enable code scanning alerts for secrets
Why it's wrong here
Code scanning runs static analysis to identify code quality and security issues (e.g., injection flaws) but does not natively detect and block secrets at push time. While custom CodeQL queries can find some secret patterns, the resulting alerts are informational and do not provide a hard enforcement mechanism to prevent secret data from being committed.
Go deeper
Related to this question
Learn chapter
Implementing Deployment Patterns and Strategies
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
Key term
Repository
A repository is a central storage location where software packages, code, or configuration files are kept, managed, and distributed for use by IT systems.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.