AZ-400 Develop a security and compliance plan Practice Question
Your team uses Azure DevOps and wants to automatically scan pull requests for secrets before they are merged. Which Azure DevOps feature should you use?
⚠ Common exam trap
Candidates may confuse the built-in secret scanning with a standalone feature, but in Azure DevOps, secret scanning is only available through GitHub Advanced Security (which requires appropriate licensing).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GitHub Advanced Security.
GitHub Advanced Security (GHAS) for Azure DevOps provides secret scanning that automatically detects secrets (e.g., API keys, passwords, connection strings) in pull requests before they are merged. This feature is integrated into Azure Repos when Advanced Security is enabled and triggers on PR creation, blocking the merge if secrets are found. Therefore, the correct choice is GitHub Advanced Security, not a separate 'Secret scanning in Azure DevOps' feature, which does not exist as a native built-in feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy.
Why it's wrong here
Azure Policy is an Azure governance service that enforces compliance rules on Azure resource configurations (such as allowed locations or tagging), but it cannot scan source code, commit history, or repository contents for embedded secrets. Because it operates at the ARM/control-plane level and never inspects code artifacts, it is not a valid tool for automatic secret detection in Azure Repos.
- ✗
Secret scanning in Azure DevOps.
Why it's wrong here
Secret scanning in Azure DevOps is the correct built-in capability for automatically detecting credentials and other sensitive strings in Azure Repos. It scans the full commit history and contents of pushed code, can block pushes containing high-confidence secrets or flag them as alerts, and is part of the Azure DevOps security features designed specifically for repository-level secret discovery.
- ✓
GitHub Advanced Security.
Why this is correct
GitHub Advanced Security (GHAS) is a suite of security tools—including secret scanning, code scanning, and dependency review—that is tightly integrated with GitHub repositories, not with Azure Repos in Azure DevOps. Because GHAS secret scanning only works within the GitHub ecosystem and cannot be configured to scan Azure Repos, it is not applicable to this Azure DevOps pipeline scenario.
- ✗
Branch policy with a required reviewer.
Why it's wrong here
A branch policy with a required reviewer is a control that mandates human approval before a pull request can complete, but it does not automatically scan code for secrets. While a reviewer might spot obvious credentials, that manual process is unreliable and does not match the requirement for an automatic scan; it also does not scan historical commits or block a push at the server level.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Repos
Azure Repos is a set of version control tools that allow teams to manage their source code, track changes, and collaborate on software projects using Git or Team Foundation Version Control (TFVC) within the Microsoft Azure ecosystem.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.