Question 129 of 823
AZ-400 Configure processes and communications Practice Question
Which TWO GitHub Actions features can be used to enforce deployment approvals for a production environment? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse branch protection rules (which control code merges) with environment-level deployment protection rules (which control deployment approvals), leading candidates to incorrectly select branch protection rules as a mechanism for deployment approvals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deployment protection rules that require approval.
Deployment protection rules in GitHub Actions allow you to define required approvals before a workflow job can deploy to an environment. These rules are configured at the environment level and can mandate that a specific number of reviewers approve the deployment, effectively enforcing a manual approval gate for production environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deployment protection rules that require approval.
Why this is correct
Deployment protection rules, when configured on an environment, can require manual approval from specified reviewers before a job referencing that environment can run. This pauses the workflow and enforces a human gate prior to deployment.
- ✗
The 'deployment' event trigger in a workflow.
Why it's wrong here
The 'deployment' event trigger fires only when a deployment is created via the API or UI; it does not enforce approvals or block the deployment. It simply initiates a workflow run, meaning it is a reaction to deployment activity, not a protection mechanism.
- ✓
Environments with required reviewers.
Why this is correct
Environments with required reviewers are a built-in deployment protection rule: each job that references the environment waits for explicit approval from designated users or teams before proceeding. This enforces mandatory human sign-off as a deployment gate.
- ✗
Branch protection rules that require pull request reviews.
Why it's wrong here
Branch protection rules that require pull request reviews govern code changes and merge eligibility on a branch; they do not influence workflow execution or environment-based deployment approvals. They protect the source code, not the deployment pipeline.
- ✗
OpenID Connect (OIDC) for cloud provider authentication.
Why it's wrong here
OpenID Connect (OIDC) is an authentication mechanism that lets GitHub Actions obtain short-lived tokens for cloud providers, replacing stored secrets. It addresses identity and access control only, not approval workflows, so it cannot enforce manual deployment approval.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 25, 2026
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.