AZ-400 Develop a security and compliance plan Practice Question
Your Azure DevOps organization contains multiple teams. You need to ensure that code reviews require approval from a member of the security team before merging to the main branch. What is the best way to implement this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure branch policies in Azure Repos
Configuring branch policies in Azure Repos (option D) is the correct approach because branch policies allow you to require specific reviewers—such as members of the security team—for pull requests targeting the main branch. This ensures that every merge to main must be approved by the security team. Option A is incorrect: Azure Pipelines is designed for continuous integration and delivery (CI/CD), not for enforcing code review requirements. Option B is incorrect: Microsoft Defender for Cloud focuses on cloud security posture management and threat protection, not on code review policies. Option C is incorrect: Microsoft Sentinel is a security information and event management (SIEM) tool for security analytics and threat intelligence, not for managing branch-level review policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a validation step in Azure Pipelines
Why it's wrong here
A pipeline validation step can run automated checks, but approval gates in pipelines are not equivalent to mandatory code reviewers. Pull request reviewer requirements are enforced by branch policies in Azure Repos, not by pipeline tasks, so this option cannot enforce the specified review policy.
- ✗
Enable Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud provides cloud security posture management and workload protection across Azure, on-premises, and multi-cloud environments. It does not define Azure Repos branch policies or enforce pull request reviewer requirements, so it is not the correct solution for requiring specific reviewers.
- ✗
Deploy Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native SIEM/SOAR solution used for security information and event management, threat detection, and incident response. It ingests logs and creates alerts but does not interact with Azure Repos pull request workflows to mandate reviewers, making it unsuitable for this requirement.
- ✓
Configure branch policies in Azure Repos
Why this is correct
In Azure Repos, branch policies on the main branch can require a minimum number of reviewers and specific approvers for pull requests. Configuring such policies enforces that designated team members must approve changes before merging, directly satisfying the requirement.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
Key term
Continuous integration
Continuous integration is a DevOps practice where developers frequently merge their code changes into a shared repository, with each merge triggering an automated build and test process to catch integration errors early.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.