AZ-400 Credential Scanner Practice Question
Your team is adopting a shift-left security approach in Azure Pipelines. They want to automatically detect secrets, such as API keys or connection strings, in source code before code is committed. Which Azure DevOps feature should be configured to scan pull requests for secrets and block the PR if any are found?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secret Scanning
Azure DevOps Secret Scanning is the built-in feature that automatically detects secrets in Azure Repos and can block pull requests when secrets are found. While a Credential Scanner task can also be added to a pipeline, Secret Scanning is the native feature designed for this purpose and is the correct answer. Options A and C are unrelated, and B is a pipeline task, not the primary Azure DevOps feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy for Repos
Why it's wrong here
Azure Policy for Repos enforces organizational governance and compliance rules on repositories, such as branch policies and file path restrictions, but it operates at the resource and management level rather than on code content; it has no capability to scan pull request diffs for hardcoded secrets.
- ✗
Credential Scanner task in pipeline
Why it's wrong here
Correct. The Credential Scanner task can be added to a pipeline to automatically detect secrets in pull requests and block if found.
- ✗
Dependency Scanning
Why it's wrong here
Dependency Scanning tools (e.g., OWASP Dependency-Check or Retire.js) analyze third-party libraries for known vulnerabilities (CVEs), but they do not scan source code or configuration files for embedded credentials; therefore, they cannot detect or block secrets in pull requests.
- ✓
Secret Scanning
Why this is correct
Secret Scanning is a GitHub Advanced Security feature, not a built-in Azure DevOps feature; the correct equivalent in Azure DevOps is the Credential Scanner task.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.