AZ-400 Develop a security and compliance plan Practice Question
Your company uses Azure DevOps and must comply with SOC 2. The auditor requires proof that all production deployments went through a change management process with approval. What should you implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure release approval gates in Azure Pipelines
Release approval gates in Azure Pipelines enforce a formal approval process before deployment, providing the required change management and approval evidence for SOC 2 audits. Option A is incorrect because branch policies control code changes, not deployments. Option B is incorrect because pipeline retention policies only manage artifact storage, not approval process. Option C is incorrect because audit logging records events but does not enforce an approval process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use branch policies to require pull request approvals
Why it's wrong here
Branch policies that require pull request approvals govern when code is merged into a branch, not when a build or release is deployed to an environment; they cannot insert a manual authorization step in the CD release pipeline, so they fail to meet SOC 2 change-management approval requirements for production deployments.
- ✗
Set pipeline retention policies to keep deployment records
Why it's wrong here
Pipeline retention policies determine how long runs, logs, and artifacts are stored, which supports audit evidence but does not enforce or require a human approval before a deployment proceeds; without an actual approval gate, SOC 2's authorization control is not satisfied.
- ✗
Enable audit logging for all pipelines
Why it's wrong here
Enabling audit logging records user and pipeline activities for later investigation, but it is a passive, detective control; it does not prevent or require approval of a deployment, so SOC 2's preventive control for deployment authorization remains unmet.
- ✓
Configure release approval gates in Azure Pipelines
Why this is correct
Release approval gates in Azure Pipelines require designated approvers to explicitly approve a release stage before it continues, directly enforcing a formal sign-off step for production deployments—this aligns with SOC 2's change-management and authorization requirements by making approval a mandatory precondition.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Release approval
A checkpoint in Azure DevOps that requires manual or automated validation before a release can proceed to a specific environment.
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.