Why an S/MIME Signed Commit Gets Rejected on a GPG-or-SSH Branch Policy
Your organization requires that all code changes be signed using a valid code signing certificate before they can be merged. Which feature in GitHub should you enable to enforce this?
⚠ Common exam trap
AZ-400 often tests the confusion between commit signature verification (authorship integrity) and code scanning/secret scanning (vulnerability and credential detection) — only signature verification enforces signed commits.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Commit signature verification.
GitHub's commit signature verification uses GPG, SSH, or S/MIME keys to cryptographically sign commits and tags, and branch protection/rulesets can require signed commits before merging. This enforces that all code changes carry a verified signature tied to a trusted identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dependabot.
Why it's wrong here
Dependabot is a tool for automated dependency updates, creating pull requests when newer versions of libraries are available. It does not enforce or verify commit signatures, so while it helps keep dependencies patched, it cannot meet a requirement for signing all code changes.
- ✓
Commit signature verification.
Why this is correct
Commit signature verification requires each commit to be cryptographically signed with a verified key (e.g., GPG, SSH, or S/MIME) and the signature to be verified by the repository host. Enabling this in Azure Repos or GitHub protects the integrity and authenticity of every change, directly ensuring that all code changes are signed.
- ✗
Code scanning.
Why it's wrong here
Code scanning analyzes source code for security vulnerabilities and coding errors using static analysis, often integrated with CI/CD. It does not check commit signatures or enforce signing policy, so it cannot address a requirement that all code changes be signed.
- ✗
Secret scanning.
Why it's wrong here
Secret scanning looks for sensitive information such as API keys, tokens, and connection strings that are accidentally committed to a repository. It is a security control for preventing credential leakage, but it has no role in enforcing or verifying commit signatures, making it irrelevant to this requirement.
Go deeper
Related to this question
Learn chapter
Managing Infrastructure as Code Using Azure
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 696 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.