AZ-400 Configure processes and communications Practice Question
An organization uses Azure DevOps and wants to implement a change management process where all changes to the main branch require approval from a change advisory board (CAB). The CAB members are not part of the development team. How should they configure this?
⚠ Common exam trap
A common mix-up: candidates confuse branch permissions (which control who can push) with branch policies (which control the review process), leading them to choose Option A instead of the correct policy-based solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new branch policy on main that requires a minimum number of reviewers from a separate CAB group.
Azure DevOps branch policies allow you to enforce a minimum number of reviewers from a specific security group (e.g., a CAB group) on pull requests targeting the main branch. This ensures that every change to main requires explicit approval from CAB members, who are separate from the development team, without relying on manual processes or altering team membership.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set branch permissions to restrict push to main and only allow CAB to approve via manual process.
Why it's wrong here
Branch permissions only control who can push to a branch; they do not enforce a required number of approvals. Approvals must be enforced by a branch policy that specifies a minimum reviewer count, not by manual permission settings.
- ✓
Create a new branch policy on main that requires a minimum number of reviewers from a separate CAB group.
Why this is correct
A branch policy on main can require a minimum number of reviewers from a specific Azure DevOps group, such as a separate CAB. This ensures automated enforcement of the approval requirement, so pull requests cannot be completed without the mandated CAB reviews.
- ✗
Use a service hook to notify CAB when a PR is created, and rely on manual approval.
Why it's wrong here
Service hooks only send HTTP notifications or trigger external systems; they do not block or enforce pull request approvals. Reliance on manual process after a notification provides no guaranteed enforcement, unlike an automated branch policy.
- ✗
Add the CAB as members of the development team and require team review.
Why it's wrong here
Adding CAB members to the development team increases their permissions and may not be appropriate for separation of duties. Furthermore, a team review policy considers all team members equally, so it does not guarantee a minimum number of approvals specifically from the CAB group.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Board
In Azure DevOps, a Board is a visual tool that helps teams plan, track, and manage work items through different stages of a development process.
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.