Exam AZ-400 topic 5 question 42 discussion

CodeQL actions for code analysis. Dependabot is mainly used checking vulnerbilities in dependencies

Dependabot is complementary to CodeQL. While CodeQL detects security issues in your own code, Dependabot detects vulnerabilities that originate from your project’s dependencies. A recent example was Log4j, which introduced a number of upstream impacts for package registries and dependencies. Since Log4j is widely used across apps and websites to help log activity in applications and websites, this incident meant a lot of people were suddenly forced to quickly update their Log4j versions to avoid any potential issues. Source: https://github.blog/2022-04-22-5-simple-things-every-developer-can-do-to-ship-more-secure-code/#:~:text=Dependabot%20is%20complementary%20to%20CodeQL,for%20package%20registries%20and%20dependencies.

Dependabot also automatically checks dependencies for vulnerabilities in your code. It is designed to monitor and notify of package and dependency updates, including information about known vulnerabilities. Therefore, Dependabot is a valid option to check dependencies in your repository for vulnerabilities. However, if you want to check all parts of the code, including vulnerabilities in the source code itself, "CodeQL actions" can provide a more comprehensive analysis.

CodeQL 's goal is search vulnerabilities

The correct answer is C. CodeQL actions scans your code for vulnerability usually as a workflow process you setup while Dependabots which is often automatic set by GitHub scans only your dependencies.

GitHub sends Dependabot alerts when we detect that your repository uses a vulnerable dependency or malware. https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts

dependabot is for secrets

C. CodeQL actions Static analysis tool to your code for potential security vulnerabilities and other code-related issues. >Dependabot alerts, focused on dependencies to detect security vulnerabilities. >Branch protection rules, enforce certain checks and restrictions before allowing changes to be merged, e.g. Require an code review, ensure that all tests pass, specify number of approving reviews. >GitHub Advisory Database, Central repository of known vulnerabilities that can be accessed by various security-related tools, e.g. Dependabot.

Discover vulnerabilities across the entire code base. https://codeql.github.com/docs/