Question 687 of 823
Two Actions That Enforce Security Scans and Compliance Approval on Every Build
A company is adopting Azure DevOps and needs to ensure that all pipelines comply with regulatory standards. The security team wants to enforce that every build includes a security scan and that deployment to production requires approval from a compliance officer. Which TWO actions should the DevOps engineer take?
Quick Answer
Meeting both requirements takes a mandatory security-scan template every pipeline must reference, plus a required reviewer approval configured on the production stage so a compliance officer has to sign off before anything reaches production. Branch policies only apply to pull requests rather than every build, and simply storing scan results doesn't actually enforce that the scan ran.
⚠ Common exam trap
Test-takers frequently confuse branch policies (Option A) with build-level enforcement, not realizing that branch policies only apply to pull request validation, not to all builds triggered by other events like CI or scheduled triggers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a required template that includes the security scan task and mandate its use via a pipeline resource.
Creating a required template with the security scan task and mandating its use via a pipeline resource ensures every pipeline inherits the security scan. Option D is correct because configuring a required reviewer approval on the production stage enforces compliance officer approval. Options A, C, and E are incorrect: Branch policies (A) only apply to pull requests, not all builds; storing results (C) does not enforce the scan; and while a pipeline decorator (E) can run a scan on every build, it does not enforce the required approval for production deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure branch policies to require a security scan on pull requests.
Why it's wrong here
Configuring branch policies to require a security scan on pull requests only applies to pull request validation, not to all builds triggered by other events like CI or scheduled triggers, so it does not ensure every build includes a security scan.
- ✓
Create a required template that includes the security scan task and mandate its use via a pipeline resource.
Why this is correct
Creating a required template with the security scan task and mandating its use via a pipeline resource ensures every pipeline inherits the security scan, enforcing compliance across all builds.
- ✗
Add a variable group to store security scan results and reference it in the pipeline.
Why it's wrong here
Adding a variable group to store security scan results does not enforce that the scan is run; it only stores results, so it does not ensure compliance.
- ✓
Configure a required reviewer approval on the production stage of the release pipeline.
Why this is correct
Configuring a required reviewer approval on the production stage of the release pipeline enforces that a compliance officer must approve before deployment, meeting the regulatory requirement.
- ✗
Use a pipeline decorator to automatically run a security scan on every build.
Why it's wrong here
Using a pipeline decorator to automatically run a security scan on every build does not enforce compliance officer approval for production deployment, and it does not ensure the scan is part of a standardized, required template.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team uses Azure Pipelines to deploy to multiple environments. The compliance team requires that all deployments to the production environment are approved by a security officer. Which feature should you use?
easy- ✓ A.Configure approvals and checks on the production environment in Azure Pipelines.
- B.Create a branch policy that requires approval for pull requests.
- C.Use a service connection with a managed identity that requires approval.
- D.Store the production credentials in a variable group with approval required.
Why A: Approvals and checks in Azure Pipelines allow you to require manual approval before a deployment to a specific environment, such as production. By configuring an approval on the production environment, you ensure that a designated security officer must approve the deployment before it proceeds, meeting the compliance team's requirement.
Variation 2. You maintain a classic release pipeline that deploys to multiple environments. You need to ensure that a deployment to the Production environment only proceeds after a manual approval from a specific group of users. Which feature should you configure?
medium- A.Post-deployment approvals on the Production environment
- B.Deployment queue settings on the Production environment
- C.Deployment gates on the Production environment
- ✓ D.Pre-deployment approvals on the Production environment
Why D: Pre-deployment approvals are configured on an environment to require manual sign-off before a release is deployed to that environment. In a classic release pipeline, this ensures that the deployment to Production only proceeds after a specific group of users has approved it, meeting the requirement for manual approval before deployment.
Variation 3. Your team wants to include a manual validation step before deploying to production. Which Azure Pipelines feature should they use?
easy- A.Pipeline decorators.
- B.Environment checks.
- ✓ C.Pre-deployment conditions with approval gates.
- D.Post-deployment gates.
Why C: Pre-deployment conditions with approval gates allow you to require manual approval before a release is deployed to a specific stage, such as production. This is the correct feature because it explicitly pauses the pipeline before deployment and waits for designated approvers to validate the build, meeting the requirement for a manual validation step. Environment checks are a broader feature that can include both automated checks and manual approvals; however, the specific configuration for requiring manual approval in a release pipeline is pre-deployment conditions with approval gates.
Variation 4. You have a release pipeline that deploys to multiple stages. You want to ensure that a manual approval is required before deploying to the production stage. Which approach should you use?
medium- ✓ A.Add a pre-deployment approval on the production stage.
- B.Add a post-deployment approval on the staging stage.
- C.Configure a deployment gate with a manual intervention task.
- D.Use a pipeline decorator to inject approval step.
Why A: Pre-deployment approvals in Azure Pipelines allow you to require manual sign-off before a release proceeds to a specific stage. By adding a pre-deployment approval on the production stage, the pipeline will pause and wait for designated approvers to approve the deployment, ensuring that no code reaches production without explicit authorization.
Variation 5. You are designing a compliance strategy for Azure DevOps pipelines that deploy to production. The company policy requires that all production deployments must be reviewed by a security lead. Additionally, the deployment must use a specific release pipeline that has been pre-approved. How should you implement this?
medium- A.Create a branch policy that requires the security lead to approve the pull request before merging.
- ✓ B.Define a 'production' environment in Azure DevOps and configure an approval check that requires the security lead. Have the pipeline deploy to that environment.
- C.Use a Classic release pipeline with a pre-deployment approval gate for the production stage.
- D.Store the approved pipeline definition in a variable group and reference it in all pipelines.
Why B: Azure DevOps environments allow you to define approval checks that must be satisfied before a deployment proceeds. By creating a 'production' environment and adding a pre-deployment approval check requiring the security lead, you enforce the mandatory review. The pipeline then deploys to that environment, ensuring only the pre-approved release pipeline is used.
Last reviewed: Jun 11, 2026
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.