AZ-400 Configure processes and communications Practice Question
Your organization uses GitHub Advanced Security. You need to ensure that secrets detected in pull requests automatically block the PR from merging. What should you configure?
⚠ Common exam trap
It's easy for candidates to confuse push protection (which blocks pushes) with the 'Block pull requests' property (which blocks PR merges), leading candidates to incorrectly select push protection as the solution for merge blocking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a custom secret scanning pattern and set the 'Block pull requests' property.
GitHub Advanced Security allows you to create custom secret scanning patterns with a 'Block pull requests' property. When enabled, this property prevents a pull request from being merged if the custom pattern detects a secret in the PR's changes, directly meeting the requirement to automatically block merging on secret detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure a custom secret scanning pattern and set the 'Block pull requests' property.
Why this is correct
The correct approach is to configure a custom secret scanning pattern with the 'Block pull requests' property enabled. When a pull request contains a secret matching the custom pattern, the PR check fails and the merge is blocked, directly satisfying the requirement to block PRs when secrets are detected.
- ✗
Configure a code scanning query to detect secrets.
Why it's wrong here
Code scanning queries are designed to analyze source code for vulnerabilities, logic errors, and other code-quality issues, not to detect secrets. Even if you write a custom CodeQL query, secret scanning is a separate GitHub Advanced Security feature specifically for identifying exposed credentials and tokens.
- ✗
Enable secret scanning and set the severity to critical.
Why it's wrong here
Secret scanning itself does not have a 'severity' setting that can be configured to critical, and even if it did, severity levels only help with alert triage and prioritization. Setting a severity does not automatically block or fail pull requests; you need the 'Block pull requests' property on a custom pattern to enforce a merge block.
- ✗
Enable push protection for secret scanning.
Why it's wrong here
Push protection blocks the push of a secret to the repository before the commit is accepted, preventing the secret from being captured. However, this occurs before a pull request is created, so it does not block the PR merge itself; the requirement specifically asks for blocking pull requests, not preventing pushes.
Go deeper
Related to this question
Learn chapter
Implementing Deployment Patterns and Strategies
Key term
GitHub Advanced Security
GitHub Advanced Security is a suite of security tools integrated into GitHub that helps developers find and fix vulnerabilities, secrets, and code quality issues directly in their repositories.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.