Design and implement a source control strategy →mediumMultiple ChoiceObjective-mapped

Why a Direct Push to a Protected Main Branch Is Blocked

Exhibit

Refer to the exhibit.

```json
{
  "repositorySettings": {
    "defaultBranch": "main",
    "requireLinearHistory": false,
    "allowForcePush": false,
    "branchPolicies": [
      {
        "branchName": "main",
        "requiredReviewers": 2,
        "checkForLinkedWorkItems": true,
        "buildValidation": {
          "buildDefinitionId": 123,
          "displayName": "CI Build",
          "manualQueueOnly": false
        }
      }
    ]
  }
}
```

Refer to the exhibit. An Azure DevOps administrator has configured the branch policy for the main branch as shown. A developer attempts to push a commit directly to the main branch. What will happen?

Quick Answer

A direct push to a protected main branch gets rejected outright when the branch policy requires pull requests — Azure Repos enforces this at the server level, blocking the push before it's even accepted, well before any build validation or other checks would have a chance to run.

⚠ Common exam trap

It's easy for candidates to assume build validation or other policies are the primary gate, when in fact the 'Require a pull request before merging' setting is the first and most restrictive policy that blocks direct pushes regardless of other policy states.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The push is rejected because branch policies require a pull request

The branch policy for the main branch requires that all changes be submitted via a pull request. When a developer attempts to push a commit directly to main, Azure Repos enforces this policy by rejecting the push. The push is blocked at the server level before any build validation or other checks occur.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The push triggers the build validation pipeline
Why it's wrong here
Build validation runs as part of pull request, not direct push.
✗
The push is allowed because allowForcePush is false
Why it's wrong here
allowForcePush false does not allow normal pushes.
✓
The push is rejected because branch policies require a pull request
Why this is correct
Branch policies enforce pull request requirement.
✗
The push is allowed because requireLinearHistory is false
Why it's wrong here
Linear history is separate from push permission.

Go deeper

1 more way this is tested on AZ-400

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. You are migrating repository policies from Azure Repos to GitHub. The JSON shows a branch protection rule you plan to apply to the main branch. A developer pushes a hotfix directly to main without a pull request. What happens?

medium

A.The push is blocked because required status checks are not met.
B.The push is blocked because enforceAdmins is true.
✓ C.The push succeeds because no push restriction is defined.
D.The push is rejected because lockBranch is false.

Why C: The branch protection rule includes required status checks and lockBranch (set to false), but it does not require pull requests before merging. In GitHub, direct pushes to a branch are only blocked if 'Require a pull request before merging' is enabled. Since that is not present here, the developer can push directly to main without a pull request, and the push succeeds. Options A and B are incorrect because required status checks and enforceAdmins do not block direct pushes; they only affect pull request merges. Option D is incorrect because lockBranch set to false allows modifications.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.

Why a Direct Push to a Protected Main Branch Is Blocked

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on AZ-400