AZ-400 Develop a security and compliance plan Practice Question
Which TWO tools can be used to enforce branch protection policies in GitHub repositories? (Choose two.)
⚠ Common exam trap
It's easy for candidates to confuse GitHub Actions workflows with branch protection rules, but workflows are event-driven automation and cannot enforce merge restrictions, whereas branch protection rules and Azure Pipelines branch policies are specifically designed for that purpose.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Pipelines branch policies
Azure Pipelines branch policies allow you to enforce requirements such as requiring a minimum number of reviewers, checking for linked work items, or requiring a successful build before merging pull requests into protected branches. This integrates directly with GitHub repositories to enforce compliance and code quality standards.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Pipelines branch policies
Why this is correct
Azure Pipelines branch policies are a correct tool because, when a repository is hosted on GitHub, Azure Pipelines can integrate directly with GitHub's branch protection system. It enables required status checks (such as successful pipeline builds) to be mandatory for pull request completion, effectively enforcing policies like 'build must pass' on protected branches.
- ✗
Microsoft Intune compliance policies
Why it's wrong here
Microsoft Intune compliance policies are incorrect for this scenario because Intune is a cloud-based service focused on mobile device management (MDM) and mobile application management (MAM). It manages device compliance, app protection, and conditional access for endpoints, not source code branch-level rules in a Git repository.
- ✓
GitHub branch protection rules
Why this is correct
GitHub branch protection rules are a correct tool because they are natively built into GitHub to enforce policies on branches. You can require pull request reviews, status checks, signed commits, and linear history, and apply these rules to prevent direct pushes or force pushes on critical branches.
- ✗
Microsoft Purview data classification
Why it's wrong here
Microsoft Purview data classification is not a valid choice because Purview is a data governance and compliance solution that helps organizations map, classify, and monitor sensitive data across their data estate. It does not interact with Git repository branch policies or enforce code review workflow rules.
- ✗
GitHub Actions workflows
Why it's wrong here
GitHub Actions workflows are incorrect because while they can run automated checks like tests and builds (which can be required as status checks via branch protection), they do not themselves enforce protection rules. Enforcement is always delegated to GitHub's branch protection settings; Actions only execute jobs and report results.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.