AZ-400 Develop a security and compliance plan Practice Question
Your team uses GitHub and wants to automatically detect and block secrets pushed to repositories. Which GitHub feature should you enable?
⚠ Common exam trap
A common mistake is selecting 'Secret scanning' because it is a broader feature, but the question specifically requires blocking. Push protection is the sub-feature that actually blocks the push, while secret scanning provides the underlying detection mechanism. You can enable push protection as part of secret scanning, but the blocking action is performed by push protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Push protection
Push protection is the GitHub feature that automatically detects known types of secrets in pushed content and blocks the push, preventing exposure. Secret scanning, on the other hand, scans for secrets and alerts after they exist in the repository but does not block the push unless push protection is enabled. Since the requirement is to 'automatically detect and block secrets pushed', the feature to enable is Push protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dependabot alerts
Why it's wrong here
Dependabot alerts scan your project's dependency manifests for known Common Vulnerabilities and Exposures (CVEs) and supply-chain risks, but they do not inspect code or commits for leaked credentials or API keys. They are therefore not the feature that automatically detects secrets in a GitHub repository.
- ✗
Code scanning
Why it's wrong here
Code scanning, powered by CodeQL, performs static analysis to find code-quality bugs and security vulnerabilities in source code, but it does not search for plaintext secrets committed to the repository. Secret detection is handled by a separate, dedicated mechanism, so code scanning is not the right answer.
- ✓
Push protection
Why this is correct
Push protection is not an independent feature; it is a layer built into secret scanning that blocks git pushes when a known secret is detected. It relies entirely on secret scanning's detection engine, so it cannot be the feature that automatically detects secrets by itself.
- ✗
Secret scanning
Why it's wrong here
Secret scanning automatically monitors repositories for known secret formats, such as GitHub personal access tokens, cloud provider keys, and private keys, and can be extended with custom regex patterns. It detects and alerts on secrets in code and commit history, making it exactly the feature described.
Go deeper
Related to this question
Learn chapter
Implementing Work Item Management and Agile Planning
Key term
Repository
A repository is a central storage location where software packages, code, or configuration files are kept, managed, and distributed for use by IT systems.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.