Matching Reviewer Count, Work Item Links, Build Success, and Merge Types
Your project uses a monorepo in Azure Repos. You want to enforce that changes to a specific folder (/src/security) require approval from the security team. What is the best approach?
Quick Answer
A branch policy with a path filter scoped to /src/security, requiring approval from the security team group, only triggers that additional review when a pull request actually touches files in that folder — leaving pull requests that don't touch security-sensitive paths unaffected by the extra approval requirement.
⚠ Common exam trap
Test-takers frequently confuse folder-level permissions (which control direct access) with branch policy path filters (which enforce workflow approvals), leading them to select Option D instead of the correct branch policy configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a branch policy with a path filter and require approval from the security team group.
Azure Repos branch policies allow you to define path filters that scope policy enforcement to specific folders. By adding a required reviewer policy with a path filter for `/src/security` and assigning the security team group, only pull requests modifying files under that folder will require their approval, leaving other changes unaffected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a required reviewer policy for all pull requests.
Why it's wrong here
A blanket required-reviewer policy applies to every pull request in the repository, not only those touching /src/security, so unrelated changes are blocked unnecessarily. It is tempting because required reviewers are the standard approval mechanism, and it would be correct if the whole repository needed security sign-off.
- ✓
Configure a branch policy with a path filter and require approval from the security team group.
Why this is correct
Azure Repos branch policies support path filters, letting you scope required approvals to /src/security only. Assigning the security team group as required reviewer enforces their sign-off on changes touching that folder, while other paths remain unaffected.
- ✗
Move the security folder to a separate repository with its own policies.
Why it's wrong here
Splitting the repository discards the monorepo's shared history and cross-folder atomic commits, and Azure Repos path-scoped branch policies already target /src/security directly. Separate repositories suit teams needing fully independent release cadences and permissions, not folder-level approval within one codebase.
- ✗
Set folder-level permissions to restrict who can modify the folder.
Why it's wrong here
Folder permissions control who may commit to /src/security, but they cannot require a separate security-team approval before a pull request completes. They are tempting because path-scoped permissions are the obvious access-control tool, and they would be correct if the goal were merely to prevent unauthorised edits.
Go deeper
Related to this question
Learn chapter
Implementing Security and Compliance in Pipelines
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
Key term
Azure Repos
Azure Repos is a set of version control tools that allow teams to manage their source code, track changes, and collaborate on software projects using Git or Team Foundation Version Control (TFVC) within the Microsoft Azure ecosystem.
About these practice questions
One of 696 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team wants to automatically assign a code reviewer from a specific security group when a pull request modifies files in a 'security' folder. Which Azure DevOps feature should you use?
easy- ✓ A.Add a required reviewer policy for the branch.
- B.Enable 'Automatically approve' for security group.
- C.Code ownership policy with automatic reviewer assignment.
- D.Branch policy with minimum number of reviewers.
Why A: Azure DevOps branch policies include a 'Required reviewers' policy that can be configured with a path filter. By specifying the path 'security' and adding the security group as required reviewers, the system will automatically add those reviewers to any pull request that modifies files in that folder. This is the built-in feature designed for this scenario. A CODEOWNERS file can also suggest reviewers based on file paths, but it is not a branch policy and does not enforce that the review must occur.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.