AZ-400 Design and implement source control Practice Question
An organization uses Azure Repos with multiple Git repositories. They want to enforce that all commits to the main branch are signed using GPG keys. Which combination of actions is required to enforce commit signing?
⚠ Common exam trap
Test-takers frequently confuse authentication methods (SSH keys, PATs) with commit signing (GPG keys), leading candidates to select options that address access control rather than cryptographic integrity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure branch policy to require signed commits and have developers configure Git to sign commits with their GPG key.
Azure Repos supports a branch policy that requires commits to be signed, and developers must configure Git to sign commits with their GPG key using `git config --global user.signingkey` and `git commit -S`. This ensures that only signed commits are accepted into the main branch, enforcing non-repudiation and integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure branch policy to require signed commits and have developers add their SSH public key to Azure Repos.
Why it's wrong here
SSH public keys in Azure Repos are used for SSH authentication and identify the developer for git operations, but Azure Repos branch policies that require signed commits verify GPG or S/MIME signatures, not SSH keys. SSH keys do not provide the cryptographic commit signature that the policy checks for, so this configuration would not satisfy the requirement.
- ✗
Configure repository settings to require a personal access token (PAT) for each commit.
Why it's wrong here
A personal access token (PAT) is an authentication mechanism for Azure DevOps REST APIs and git HTTPS operations; it is not a signing key and cannot be used to create cryptographic commit signatures. Requiring a PAT for each commit only enforces authentication, not integrity or non-repudiation, and Azure Repos branch policies do not support PAT-based commit signing validation.
- ✓
Configure branch policy to require signed commits and have developers configure Git to sign commits with their GPG key.
Why this is correct
Azure Repos branch policies can enforce that every commit in a protected branch is signed, and developers must configure their local Git client to sign commits with a GPG key (e.g., set user.signingkey and commit.gpgsign=true). When a developer pushes a signed commit, Azure Repos verifies the GPG signature against the developer's configured public key, while the private key remains securely on the developer's machine.
- ✗
Use Azure Key Vault to store signing keys and configure Azure Repos to automatically sign commits.
Why it's wrong here
Azure Key Vault can store signing keys, but Azure Repos does not provide any automatic commit-signing service that would use those keys to sign commits on a developer's behalf. Commit signing must happen locally in the Git client using a private key accessible to the developer; the branch policy can only verify signatures after they are pushed, it cannot generate signatures server-side.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Repos
Azure Repos is a set of version control tools that allow teams to manage their source code, track changes, and collaborate on software projects using Git or Team Foundation Version Control (TFVC) within the Microsoft Azure ecosystem.
Key term
Branch policy
A branch policy is a set of rules and conditions enforced on a Git branch to control how code changes are proposed, reviewed, and merged, ensuring code quality and protecting critical branches.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.