Develop a security and compliance plan →hardMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

{
  "policies": [
    {
      "name": "Enforce branch naming convention",
      "policyType": "Git",
      "settings": {
        "scope": [
          {
            "refName": "refs/heads/*",
            "matchKind": "Prefix",
            "prefix": "feature/"
          }
        ],
        "isEnabled": true,
        "isBlocking": true
      }
    },
    {
      "name": "Require a minimum number of reviewers",
      "policyType": "Approval",
      "settings": {
        "minimumApproverCount": 2,
        "creatorVoteCounts": false,
        "allowDownvotes": false,
        "resetOnPush": true
      }
    }
  ]
}

Refer to the exhibit. You are reviewing the branch policies for the main branch in Azure Repos. The team reports that while the branch naming policy works, the approval policy does not block pull requests when only one person approves. What is the most likely cause?

⚠ Common exam trap

Do not confuse repository-level settings (like branch naming) with branch-level policies (like minimum reviewers). Policies are additive and cannot be 'overridden' by another policy.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy is not applied to the main branch

Option B is correct. If the minimum approver count policy is configured for a branch other than `main` (or is scoped to a different branch pattern), it will not apply to pull requests targeting `main`. The branch naming policy works because that is a repository-level setting that applies to all branches. There is no 'project-level' branch policy override in Azure Repos; branch policies are scoped to specific branches or patterns, and if multiple policies apply, all must be satisfied. A separate policy on main that allows one approval would not override an all-branches policy requiring two approvals — the stricter policy would still block. Therefore, the cause must be that the approval policy simply does not apply to main.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy is disabled in the settings
Why it's wrong here
The exhibit explicitly shows "isEnabled": true, which confirms the policy is enabled in the branch policy settings; a disabled policy would not be evaluated at all, making this explanation incorrect.
✓
The policy is not applied to the main branch
Why this is correct
The policy's scope is set to "refs/heads/*", a wildcard that matches all branches, including "main". Therefore the policy does apply to the main branch, so this explanation cannot account for the reduced approval requirement.
✗
The main branch has a separate branch policy override that allows one approval
Why it's wrong here
In Azure DevOps, a policy with a wildcard scope like "refs/heads/*" applies to all branches, but a more specific branch-level policy can override the required number of reviewers. A separate policy on the main branch requiring only one approval would explain why the exhibit shows a single approval is sufficient.
✗
The 'creatorVoteCounts' setting is false, so the creator's approval is not counted
Why it's wrong here
The "creatorVoteCounts" setting only determines whether an approval from the pull request creator counts toward the approval count; it does not change the total number of approvals required. Thus, even with "creatorVoteCounts": false, the required approval count remains affected only by the reviewer policy settings.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question