Enforcing Required Status Checks in GitHub Enterprise Cloud
Your organization uses GitHub Actions for CI/CD. You want to enforce that all workflows pass required checks before a pull request can be merged. The repository is in an organization that uses GitHub Enterprise Cloud. What should you configure?
Quick Answer
A branch protection rule requiring status checks to pass is the direct GitHub Enterprise Cloud mechanism for this: configure it on the target branch, select the specific GitHub Actions workflow checks that must succeed, and a pull request simply can't merge until every one of those checks reports green.
⚠ Common exam trap
Candidates often confuse organization-level workflow approval settings (which control workflow execution) with branch-level status check requirements (which control merge permissions), leading candidates to select option B or C instead of the correct branch protection rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a branch protection rule that requires status checks to pass.
Branch protection rules in GitHub Enterprise Cloud allow you to require status checks to pass before merging a pull request. By configuring a branch protection rule on the target branch (e.g., main) and selecting the specific GitHub Actions workflow status checks that must succeed, you enforce that all required CI/CD checks pass before a merge is allowed. This directly meets the requirement to enforce workflow checks on pull requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a branch protection rule that requires status checks to pass.
Why this is correct
Branch protection rules can enforce that all required checks pass before merging.
- ✗
Enable 'Require approval for all workflows' in the organization settings.
Why it's wrong here
This setting requires approval for first-time contributors, not for all checks.
- ✗
Set the workflow to be required in the 'Require status check' settings of each pull request.
Why it's wrong here
The required status checks are configured at the branch level, not per PR.
- ✗
Create a repository ruleset that requires linear history.
Why it's wrong here
Linear history does not require status checks.
Go deeper
Related to this question
Learn chapter
Planning for DevOps Transformation
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
Key term
Pull request
A pull request is a way for a developer to propose changes to a codebase and ask other team members to review and merge them into the main project.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses GitHub Actions and needs to enforce that all workflows pass required checks before a pull request can be merged. Which GitHub feature should you configure?
easy- A.Workflow triggers
- ✓ B.Branch protection rules with required status checks
- C.Required reviewers
- D.Environment protection rules
Why B: Branch protection rules with required status checks enforce that all configured GitHub Actions workflows must pass before a pull request can be merged. This ensures that any workflow defined in the repository (e.g., CI, linting, security scans) produces a successful check run, and the merge is blocked if any required check fails or is pending.
Variation 2. You are designing a build validation policy for a GitHub repository. You want to ensure that all pull requests pass a CI check before they can be merged. What should you configure?
medium- A.Enable Dependabot alerts on the repository.
- B.Configure a repository rule to require a pull request before merging.
- ✓ C.Add a GitHub Actions workflow that runs on 'pull_request' and set it as a required status check in branch protection.
- D.Create a webhook to trigger a build on Azure Pipelines.
Why C: Branch protection rules in GitHub can require status checks to pass before merging. You set up a rule that requires the CI workflow to succeed.
Variation 3. Which TWO features of GitHub Actions can be used to enforce code quality standards before merging?
easy- A.Environments
- B.Secrets
- ✓ C.Branch protection rules with required status checks
- ✓ D.Status checks
- E.Repository variables
Why C: Branch protection rules with required status checks (C) enforce that pull requests must pass specific GitHub Actions workflows (e.g., linting, testing, security scans) before merging. Status checks (D) are the actual workflow runs that report pass/fail to the pull request; when required, they block merging until all checks succeed. Together, they ensure code quality gates are met automatically.
Variation 4. Your team uses Azure DevOps and wants to enforce branch protection policies for all repositories in a GitHub Advanced Security-enabled organization. Which approach should you use to ensure that pull requests require a successful status check from a required workflow?
medium- A.Use GitHub Actions secrets to store the required status check name.
- ✓ B.Define a repository rule in GitHub that requires a successful status check from a required workflow.
- C.Create a branch protection rule in each repository's settings.
- D.Configure branch policies in Azure DevOps project settings.
Why B: GitHub repository rules (also known as repository rulesets) allow organizations to centrally enforce policies like required status checks across multiple repositories. To require a successful status check from a specific workflow on all pull requests, create an organization-level repository ruleset that includes the 'Require status checks to pass' rule and specify the workflow's check name. This applies to all selected repositories without per-repository configuration. GitHub Advanced Security is not required for this feature; it is a separate security add-on.
Variation 5. Your team uses GitHub for source control and wants to enforce that all pull requests into the main branch require at least two reviewers and must pass a status check from a CI pipeline. Which branch protection rule configurations should you apply?
medium- ✓ A.Require a minimum of 2 reviewers, require status checks to pass before merging
- B.Require signed commits and status checks
- C.Require status checks to pass, but do not require reviewers
- D.Require a minimum of 2 reviewers, but do not require status checks
Why A: GitHub branch protection rules allow you to require a minimum number of reviewers before merging and to require status checks to pass. By setting 'Require a minimum number of reviewers' to 2 and enabling 'Require status checks to pass before merging', you enforce that every pull request into the main branch must be approved by at least two reviewers and must pass the CI pipeline status check, meeting the stated requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.