Ensuring Secret Scanning Alerts Get Reviewed Within a 30-Day Window
Your team uses GitHub Enterprise and GitHub Actions for CI/CD. You need to implement a security compliance plan. The organization has the following requirements: 1) All code pushed to the main branch must be scanned for secrets and vulnerabilities. 2) Developers must use signed commits. 3) Only approved GitHub Actions can be used. 4) Dependencies must be scanned for vulnerabilities. You have enabled secret scanning and code scanning (CodeQL) on all repositories. You have configured branch protection rules to require signed commits using GPG keys. To restrict actions, you have set an allowed list of actions in the organization settings. You have enabled Dependabot alerts. However, during an audit, a reviewer notes that secret scanning alerts are not being reviewed within 30 days. You need to ensure that secret scanning alerts are triaged within 30 days. What should you do?
Quick Answer
Assigning secret scanning alerts to specific security team members using the 'Assign to' feature is what actually guarantees triage within 30 days — it creates explicit ownership and accountability for each alert, whereas webhook notifications alone don't confirm anyone reviewed it, and auto-closing alerts risks hiding a genuine exposed secret.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign secret scanning alerts to the security team using the 'Assign to' feature in the alerts view.
GitHub secret scanning allows you to assign alerts to specific team members using the 'Assign to' feature in the alerts view. This ensures that alerts are explicitly owned and triaged within the 30-day requirement. Option B is incorrect because webhooks merely send notifications; they do not guarantee that someone will review and triage the alert. Option C is incorrect because disabling secret scanning on any repository would violate the requirement to scan all code pushed to main branch. Option D is incorrect because automatically closing alerts after 30 days could hide legitimate secrets that require investigation, which fails the security compliance goal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign secret scanning alerts to the security team using the 'Assign to' feature in the alerts view.
Why this is correct
Assignment ensures ownership and tracking of triage.
- ✗
Set up a webhook to send secret scanning alerts to a security team's email.
Why it's wrong here
Email notifications do not guarantee triage within 30 days.
- ✗
Disable secret scanning on repositories that do not contain secrets.
Why it's wrong here
This reduces security coverage.
- ✗
Configure secret scanning to automatically close alerts after 30 days.
Why it's wrong here
Auto-closing may dismiss real secrets.
Go deeper
Related to this question
Learn chapter
Managing Build Quality and Package Dependencies
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team uses GitHub Advanced Security to identify vulnerabilities in code. Which TWO actions can you take to ensure that critical security alerts are addressed before code is merged?
medium- A.Enable secret scanning push protection.
- B.Create a repository rule that allows bypassing pull request requirements.
- ✓ C.Configure branch protection rules to require status checks from code scanning.
- D.Enable Dependabot auto-merge for pull requests.
- ✓ E.Use pull request annotations to display code scanning alerts.
Why C: Branch protection rules can require passing status checks from code scanning and secret scanning. Pull request annotations show alerts directly in the PR. Dependabot auto-merge and repository rules for bypassing are not relevant for blocking merges based on security alerts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.