Enforcing a Minimum of Two Security Team Approvals Before Merge
Your team uses GitHub Actions for CI/CD and must ensure that only approved contributors can merge code to the main branch. You need to enforce a policy where every pull request must be reviewed by at least two members of the security team. Which branch protection rule should you configure?
Quick Answer
'Require a minimum number of reviewers,' set to two and scoped to the security team, is the branch protection rule that directly enforces this — GitHub blocks the merge until that many distinct approvals from qualifying reviewers are recorded, guaranteeing only vetted contributors can authorize a change into main.
⚠ Common exam trap
It's easy for candidates to confuse 'Require pull request reviews before merging' (which only requires at least one review) with the specific 'Require a minimum number of reviewers' rule, failing to recognize that the question explicitly demands a minimum of two reviewers from a specific team.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require a minimum number of reviewers
The 'Require a minimum number of reviewers' branch protection rule in GitHub directly enforces that a specified number of reviewers must approve a pull request before it can be merged. By setting this minimum to two and restricting review permissions to the security team, you ensure that only approved security team members can authorize merges to the main branch, meeting the policy requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require pull request reviews before merging
Why it's wrong here
This requires reviews but not a specific number of reviewers.
- ✗
Require status checks to pass before merging
Why it's wrong here
Status checks are CI checks, not code reviews.
- ✗
Dismiss stale pull request approvals
Why it's wrong here
This dismisses approvals when new commits are pushed.
- ✓
Require a minimum number of reviewers
Why this is correct
This enforces at least two reviewers from the security team.
Go deeper
Related to this question
Learn chapter
Managing Infrastructure as Code Using Azure
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
8 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Azure DevOps to manage code. They want to enforce that all changes to the main branch must go through a pull request with at least two reviewers. What should they configure?
easy- ✓ A.Branch policy on the main branch
- B.Add a tag to the main branch
- C.Repository permissions
- D.Configure a service hook
Why A: Branch policies in Azure DevOps allow you to enforce requirements on pull requests targeting a specific branch. By configuring a branch policy on the main branch, you can require a minimum number of reviewers (e.g., two) and mandate that all changes must go through a pull request. This ensures that no direct commits bypass the review process.
Variation 2. Your team uses Azure DevOps and wants to enforce that all changes to the main branch go through a pull request process with at least two approvals. They also want to prevent contributors from approving their own pull requests. Which branch policy settings should they use?
easy- A.Enable 'Check for linked work items' and 'Require a minimum number of reviewers' set to 2, and enable 'Reset code reviewer votes when new changes are pushed'.
- B.Add the 'main' branch to the 'Required reviewers' list and add all developers as required reviewers.
- C.Enable 'Require a minimum number of reviewers' set to 2, and enable 'Build validation' with a required build.
- ✓ D.Enable 'Require a minimum number of reviewers' set to 2, and enable 'Allow users to approve their own changes' unchecked (or set to false).
Why D: It directly addresses both requirements: setting 'Require a minimum number of reviewers' to 2 enforces at least two approvals, and unchecking 'Allow users to approve their own changes' prevents contributors from approving their own pull requests. These are branch policy settings within Azure Repos that control the pull request workflow on the main branch.
Variation 3. Your team uses a monorepo in Azure Repos. Developers frequently commit directly to the main branch, causing build failures. You need to enforce a policy that requires all changes to go through pull requests with at least one reviewer. What should you configure?
medium- A.Configure a repository policy to require a pull request for all branches.
- B.Create a service hook to reject commits to main that are not from pull requests.
- ✓ C.Configure a branch policy on the main branch to require a minimum number of reviewers.
- D.Enable the 'Require a minimum number of reviewers' setting in the project settings.
Why C: Azure Repos allows you to configure branch policies on specific branches (like main) to enforce that all changes must come through pull requests and require a minimum number of reviewers. This directly addresses the need to prevent direct commits to main and ensure code review before merging.
Variation 4. Your Azure DevOps project uses Git for source control. You want to enforce that all code changes are reviewed before merging into the main branch. Which branch policy should you enable?
medium- A.Allow only comment resolution.
- B.Require a successful build before merging.
- C.Limit merge types to squash merge.
- ✓ D.Require a minimum number of reviewers.
Why D: The 'Require a minimum number of reviewers' branch policy ensures that a specified number of reviewers must approve a pull request before it can be merged, directly enforcing code review. Option A is incorrect because 'Allow only comment resolution' pertains to how comments are resolved, not requiring approvals. Option B is incorrect because 'Require a successful build before merging' validates build status but does not enforce review. Option C is incorrect because 'Limit merge types to squash merge' controls the merge strategy, not the review process.
Variation 5. Your organization uses Microsoft Entra ID for identity and Azure DevOps for source control. You need to enforce that all code changes to the main branch require a pull request with at least two approvals and no failing checks. What should you configure?
hard- A.Configure a Conditional Access policy in Microsoft Entra ID
- B.Add an environment protection rule in Azure Pipelines
- ✓ C.Set up a branch policy on the main branch in Azure Repos
- D.Use a service hook to notify reviewers when a push occurs
Why C: Azure Repos branch policies allow you to enforce required pull requests, minimum number of reviewers (e.g., two approvals), and status checks (e.g., no failing checks) on the main branch. This ensures that all code changes to the protected branch comply with the defined quality and security gates before merging.
Variation 6. A development team wants to ensure that all code changes are reviewed by at least two senior developers before merging into the main branch. They use Azure Repos. What should they configure?
medium- A.Enable the build validation policy on the branch.
- B.Set up a release pipeline with gated deployments.
- ✓ C.Configure a branch policy requiring a minimum number of reviewers.
- D.Add a status check policy using Azure Functions.
Why C: Azure Repos branch policies allow you to enforce a minimum number of reviewers on pull requests. By setting the 'Minimum number of reviewers' policy to 2, the team ensures that at least two senior developers must approve any code change before it can be merged into the main branch. This directly meets the requirement without involving build validation, release pipelines, or external function calls.
Variation 7. Your organization uses Azure DevOps and requires that all pipelines enforce branch policy for pull requests. A developer creates a pipeline that builds and tests code on push to any branch. The security team wants to ensure that no code can be deployed to production without passing through a pull request with required reviewers. Which action should you take to meet this requirement?
medium- A.Disable CI triggers on the pipeline and require manual builds.
- B.Modify the service connection to require admin approval.
- C.Set the pipeline to require approval from the security team before running.
- ✓ D.Configure branch policy on the main branch to require a pull request with a minimum number of reviewers.
Why D: Azure DevOps branch policies enforce that all changes to the main branch must go through a pull request with required reviewers. This ensures no code can be deployed to production without passing through the defined review process, meeting the security team's requirement.
Variation 8. A development team uses Git for source control. They want to ensure that all code changes are reviewed before merging into the main branch. Which branch policy should they configure in Azure Repos?
easy- ✓ A.Configure a branch policy that requires a minimum number of reviewers and resolves all comments.
- B.Configure a branch policy that requires commit messages to follow a specific pattern.
- C.Configure a branch policy that requires a successful build.
- D.Configure a branch policy that requires linked work items.
Why A: Azure Repos branch policies allow you to enforce that pull requests require a minimum number of reviewers and that all comments are resolved before merging. This directly ensures that all code changes are reviewed and any feedback is addressed, meeting the team's requirement for mandatory code review before merging into the main branch.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.