AZ-400: CodeQL and GitHub Advanced Security scanning

[zkarachiwala]

Exam objective

Enable static application security testing, secret scanning, and dependency vulnerability detection using GitHub Advanced Security
(Design and implement a security and compliance plan — 10–15%)

Read first

• About CodeQL code scanning
• GitHub secret scanning
• Dependency review action

What to build

Three GitHub Advanced Security features active on the repository: CodeQL SAST on every PR, secret scanning with push protection, and dependency review blocking vulnerable packages.

Your task

1. Enable CodeQL: Security → Code scanning → Set up → Advanced — review the generated codeql-analysis.yml before committing it
2. Read the generated file: understand what languages: are detected, what queries: suite is used
3. Enable Secret scanning: Settings → Security → Secret scanning → Enable, then enable Push protection
4. Enable Dependency review: add actions/dependency-review-action as a step in the CI workflow
5. Trigger a CodeQL scan by pushing — open the Security tab and review any findings
6. For any findings: determine if each is a true positive or false positive and document your assessment in a code comment

Explore

# Check the current CodeQL scan status:
gh api repos/zkarachiwala/TimeTracker/code-scanning/analyses \
  --jq '.[0] | {tool: .tool.name, ref: .ref, created_at: .created_at, results_count: .results_count}'

# List open code scanning alerts:
gh api repos/zkarachiwala/TimeTracker/code-scanning/alerts \
  --jq '.[] | {rule: .rule.id, severity: .rule.severity, description: .rule.description, file: .most_recent_instance.location.path}'

# Test secret scanning push protection:
# Try to push a file containing a fake Azure connection string pattern — push protection should block it
# git commit -m "test" -- -  then paste a fake connection string and observe the push being rejected

# List dependency alerts:
gh api repos/zkarachiwala/TimeTracker/vulnerability-alerts --include-headers | head -5

Exam checkpoint

• What is SAST and how does it differ from DAST?
• What is the difference between the security-and-quality and security-extended CodeQL query suites?
• What types of secrets does GitHub Secret Scanning detect by default?
• What is supply chain security and how does the dependency review action address it?
• What is a CVE identifier and who assigns them?

[zkarachiwala]

Moved to study-plans — tracked in the Certifications project.