AZ-400 Practice Question: Design and implement build and release pipelines
Which TWO features in Azure Pipelines allow you to enforce separation of duties between development and operations teams? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse branch policies (which govern code merging) with deployment approvals (which govern release to environments), leading them to select branch policies instead of environment security roles or approvals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Approvals and checks on environments
Approvals and checks on environments (B) enforce separation of duties by requiring designated approvers (e.g., operations team members) to approve a deployment before it proceeds, ensuring that development cannot directly push to production. Environment security roles (D) allow you to define who can create, view, or manage environments, restricting developers from modifying production environments without operations oversight.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pipeline decorators
Why it's wrong here
Pipeline decorators automatically inject steps into every pipeline or selected stages, but they are static additions to the pipeline definition; they cannot introduce interactive approval gates or conditional authorization checks, so they do not enforce separation of duties between deployment initiators and approvers.
- ✓
Approvals and checks on environments
Why this is correct
Approvals and checks on environments are pre-deployment gates that require designated reviewers or automated checks to approve before a release proceeds; this ensures separation of duties by allowing one group to create a release and a different group to approve it, and checks can enforce policies like branch protection.
- ✗
Service connections with different scopes
Why it's wrong here
Service connections with different scopes provide the necessary credentials for deployment tasks but only grant access to resources; they do not include a workflow or approval mechanism, so they cannot enforce separation of duties or require a second person to authorize the deployment.
- ✓
Environment security roles
Why this is correct
Environment security roles define permissions for who can view, create, or deploy to an environment; by restricting the Deploy permission to a specific set of users or groups, you enforce separation of duties as only those authorized roles can trigger deployments, while others may manage the environment.
- ✗
Branch policies on the main branch
Why it's wrong here
Branch policies on the main branch, such as requiring pull request reviews or build validation, ensure code changes meet quality standards before merging, but they do not control who can deploy to an environment; deployment authorization is outside their scope, so they cannot enforce separation of duties.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.