AZ-400 Develop a security and compliance plan Practice Question
You are designing a security compliance plan for a GitHub Enterprise environment. Which THREE practices should you implement? (Select THREE.)
⚠ Common exam trap
It's easy for candidates to confuse automation account security with human user security, incorrectly assuming that 2FA can be disabled for automation accounts, or they may think bypassing branch protection is acceptable for admins, when in fact compliance requires consistent enforcement across all users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure branch protection rules to require pull request reviews
Branch protection rules with required pull request reviews enforce mandatory code review before merging, Dependabot alerts automatically monitor dependency vulnerabilities, and secret scanning detects accidental credential commits. Together these practices strengthen security compliance in GitHub Enterprise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable two-factor authentication for automation accounts
Why it's wrong here
Disabling two-factor authentication for automation accounts weakens security because these accounts often have elevated privileges for CI/CD pipelines. Even service accounts should be protected with strong authentication mechanisms such as 2FA or managed identities to prevent unauthorized access.
- ✗
Allow repository admins to bypass branch protection rules
Why it's wrong here
Allowing repository admins to bypass branch protection rules undermines compliance and auditability. Even administrators should follow the same review gates to ensure every change is reviewed and traceable, otherwise the protection becomes meaningless and weakens the security posture.
- ✓
Configure branch protection rules to require pull request reviews
Why this is correct
Requiring pull request reviews ensures that every change is reviewed by at least one other collaborator before merging, enforcing code quality and reducing the risk of introducing vulnerabilities or broken code. It also provides a clear audit trail of who approved each change, which is essential for compliance.
- ✓
Enable Dependabot alerts for dependency vulnerability monitoring
Why this is correct
Dependabot alerts automatically monitor dependencies for known security vulnerabilities and notify the repository team when issues are detected. This enables proactive remediation by providing impact details and often suggests a security update pull request to resolve the vulnerability.
- ✓
Enable secret scanning to detect accidental credential commits
Why this is correct
Secret scanning monitors repositories for accidentally committed credentials like API keys, tokens, or passwords. It alerts the team when such secrets are found, preventing them from being exposed to unauthorized users and allowing immediate rotation to mitigate potential misuse.
Go deeper
Related to this question
Learn chapter
Designing a Build Pipeline
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
Key term
Code review
A code review is a systematic examination of source code by one or more developers to find defects, improve quality, and enforce coding standards before it is merged into the main codebase.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.