AZ-400 Develop a security and compliance plan Practice Question
Your team uses GitHub Advanced Security to identify vulnerabilities in code. Which TWO actions can you take to ensure that critical security alerts are addressed before code is merged?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure branch protection rules to require status checks from code scanning.
Branch protection rules can require passing status checks from code scanning and secret scanning. Pull request annotations show alerts directly in the PR. Dependabot auto-merge and repository rules for bypassing are not relevant for blocking merges based on security alerts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable secret scanning push protection.
Why it's wrong here
Secret scanning push protection is a pre-push control that scans new commits for hardcoded secrets (API keys, passwords, tokens) and can block or warn before they reach the repository. It does not analyze application code for vulnerabilities like injection or deserialization flaws, nor does it surface code scanning alerts on pull requests or enforce their resolution. Because the scenario is about enforcing code vulnerability alert fixes, secret scanning push protection is irrelevant and does not meet the requirement.
- ✗
Create a repository rule that allows bypassing pull request requirements.
Why it's wrong here
Creating a repository rule that bypasses pull request requirements would remove mandatory review and status checks, allowing code with unresolved security alerts to merge undetected. This actively weakens the security posture rather than enforcing alert resolution, so it is wrong.
- ✓
Configure branch protection rules to require status checks from code scanning.
Why this is correct
Configuring branch protection rules to require code scanning status checks creates a hard merge gate: if CodeQL or other scanning tools detect critical vulnerabilities, the status check fails and the pull request is blocked. This enforces alert resolution before code can enter the protected branch, making it the correct answer.
- ✗
Enable Dependabot auto-merge for pull requests.
Why it's wrong here
Dependabot auto-merge will automatically merge dependency update pull requests when their required checks pass, but it does nothing to address existing vulnerabilities found in your own code by code scanning. It is unrelated to GitHub Advanced Security alert enforcement, so it is wrong.
- ✓
Use pull request annotations to display code scanning alerts.
Why this is correct
Pull request annotations from code scanning surface alerts inline on the files changed, making vulnerabilities immediately visible to reviewers during the review process. While this does not automatically block the merge, it gives teams the context needed to reject the PR until the alerts are fixed, so it is correct as a supporting measure.
Go deeper
Related to this question
Learn chapter
Managing Infrastructure as Code Using Azure
Key term
Pull request
A pull request is a way for a developer to propose changes to a codebase and ask other team members to review and merge them into the main project.
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.