AZ-400 Practice Question: Design and implement a source control strategy
Your team uses GitHub for source control. You need to ensure that sensitive data, such as connection strings, is never committed to the repository. Which tool should you use?
⚠ Common exam trap
Watch out — candidates often confuse secret scanning with Dependabot (which handles dependency vulnerabilities, not secrets) or assume GitHub Actions can be scripted to scan for secrets, but secret scanning is a dedicated, built-in feature that operates at the push level without requiring workflow configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GitHub secret scanning
GitHub secret scanning automatically detects sensitive data like connection strings, API keys, and tokens as they are pushed to a repository, preventing them from being committed. It scans for known patterns and can block the push or alert the repository administrator, making it the correct tool for this requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
GitHub Actions
Why it's wrong here
GitHub Actions is a CI/CD automation platform that executes workflows for build, test, and deployment, but it does not include built-in secret detection. While you could write custom logic or use third-party actions to scan for secrets, that is not a native feature, so it cannot directly ensure secrets are caught in source control.
- ✗
Dependabot
Why it's wrong here
Dependabot is a tool for managing dependency updates and alerting on known vulnerabilities in your project's dependencies, such as outdated or insecure packages. It does not scan your source code for exposed secrets like connection strings or API keys, so it is not a solution for secret detection in the repository.
- ✗
Git Large File Storage (LFS)
Why it's wrong here
Git Large File Storage (LFS) is designed to handle large binary files by replacing them with text pointers in the repository while storing actual content elsewhere. It focuses on storage efficiency and has no mechanism for detecting or preventing secrets, as secrets are typically small text values that remain in normal Git history.
- ✓
GitHub secret scanning
Why this is correct
GitHub secret scanning is the correct feature because it automatically scans repositories for known patterns of secrets, including connection strings, API keys, and authentication tokens. It alerts on detected secrets and can partner with secret providers to help prevent exposure, directly addressing the need to ensure secrets are not left in source control.
Go deeper
Related to this question
Learn chapter
Source Control Strategy Design
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
Key term
Repository
A repository is a central storage location where software packages, code, or configuration files are kept, managed, and distributed for use by IT systems.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.