AZ-400 Configure processes and communications Practice Question
Which TWO GitHub Actions features can be used to enforce deployment approvals for a production environment? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse branch protection rules (which control code merges) with environment-level deployment protection rules (which control deployment approvals), leading candidates to incorrectly select branch protection rules as a mechanism for deployment approvals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deployment protection rules that require approval.
Deployment protection rules in GitHub Actions allow you to define required approvals before a workflow job can deploy to an environment. These rules are configured at the environment level and can mandate that a specific number of reviewers approve the deployment, effectively enforcing a manual approval gate for production environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deployment protection rules that require approval.
Why this is correct
Deployment protection rules, when configured on an environment, can require manual approval from specified reviewers before a job referencing that environment can run. This pauses the workflow and enforces a human gate prior to deployment.
- ✗
The 'deployment' event trigger in a workflow.
Why it's wrong here
The 'deployment' event trigger fires only when a deployment is created via the API or UI; it does not enforce approvals or block the deployment. It simply initiates a workflow run, meaning it is a reaction to deployment activity, not a protection mechanism.
- ✓
Environments with required reviewers.
Why this is correct
Environments with required reviewers are a built-in deployment protection rule: each job that references the environment waits for explicit approval from designated users or teams before proceeding. This enforces mandatory human sign-off as a deployment gate.
- ✗
Branch protection rules that require pull request reviews.
Why it's wrong here
Branch protection rules that require pull request reviews govern code changes and merge eligibility on a branch; they do not influence workflow execution or environment-based deployment approvals. They protect the source code, not the deployment pipeline.
- ✗
OpenID Connect (OIDC) for cloud provider authentication.
Why it's wrong here
OpenID Connect (OIDC) is an authentication mechanism that lets GitHub Actions obtain short-lived tokens for cloud providers, replacing stored secrets. It addresses identity and access control only, not approval workflows, so it cannot enforce manual deployment approval.
Go deeper
Related to this question
Learn chapter
Implementing Deployment Patterns and Strategies
Key term
Approval gate
An approval gate is a checkpoint in an Azure DevOps release pipeline where a pipeline run pauses until a designated team or person manually approves or rejects the deployment.
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
About these practice questions
This AZ-400 question is part of Courseiva's 696-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.