Matching Reviewer Count, Work Item Links, Build Success, and Merge Types
Your project uses a monorepo in Azure Repos. You want to enforce that changes to a specific folder (/src/security) require approval from the security team. What is the best approach?
Quick Answer
A branch policy with a path filter scoped to /src/security, requiring approval from the security team group, only triggers that additional review when a pull request actually touches files in that folder — leaving pull requests that don't touch security-sensitive paths unaffected by the extra approval requirement.
⚠ Common exam trap
Test-takers frequently confuse folder-level permissions (which control direct access) with branch policy path filters (which enforce workflow approvals), leading them to select Option D instead of the correct branch policy configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a branch policy with a path filter and require approval from the security team group.
Azure Repos branch policies allow you to define path filters that scope policy enforcement to specific folders. By adding a required reviewer policy with a path filter for `/src/security` and assigning the security team group, only pull requests modifying files under that folder will require their approval, leaving other changes unaffected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a required reviewer policy for all pull requests.
Why it's wrong here
Affects all changes, not just security folder.
- ✓
Configure a branch policy with a path filter and require approval from the security team group.
Why this is correct
This ensures only changes to that path get additional review.
- ✗
Move the security folder to a separate repository with its own policies.
Why it's wrong here
Defeats purpose of monorepo.
- ✗
Set folder-level permissions to restrict who can modify the folder.
Why it's wrong here
Permissions prevent changes altogether, not enforce approval.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
Key term
Azure Repos
Azure Repos is a set of version control tools that allow teams to manage their source code, track changes, and collaborate on software projects using Git or Team Foundation Version Control (TFVC) within the Microsoft Azure ecosystem.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team wants to automatically assign a code reviewer from a specific security group when a pull request modifies files in a 'security' folder. Which Azure DevOps feature should you use?
easy- ✓ A.Add a required reviewer policy for the branch.
- B.Enable 'Automatically approve' for security group.
- C.Code ownership policy with automatic reviewer assignment.
- D.Branch policy with minimum number of reviewers.
Why A: Azure DevOps branch policies include a 'Required reviewers' policy that can be configured with a path filter. By specifying the path 'security' and adding the security group as required reviewers, the system will automatically add those reviewers to any pull request that modifies files in that folder. This is the built-in feature designed for this scenario. A CODEOWNERS file can also suggest reviewers based on file paths, but it is not a branch policy and does not enforce that the review must occur.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.