AZ-400 Develop a security and compliance plan Practice Question
Your company uses GitHub and wants to implement a compliance framework that requires signed commits for all repositories. Developers use various IDEs and Git clients. What is the best way to enforce signed commits across the organization?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Require signed commits' in the branch protection rules for the default branch.
GitHub allows repository administrators to enable 'Require signed commits' in branch protection rules. Option A is incorrect because it is not enforceable; commits can be unsigned. Option B is incorrect because it only encourages, not enforces. Option D is incorrect because it does not enforce signing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the repository to 'Require pull request reviews before merging' and rely on reviewers to check commit signatures.
Why it's wrong here
Requiring pull request reviews before merging only ensures that a human approved the change; it does not verify that each commit has a valid signature. Reviewers often check code logic, not GPG/S/MIME signatures, so unsigned commits can slip through. This is a process control, not a technical enforcement control.
- ✗
Ask developers to configure GPG keys and sign commits manually.
Why it's wrong here
Asking developers to configure GPG keys and sign commits manually is not enforceable because there is no repository-level policy that rejects unsigned commits. A developer can simply skip signing or misconfigure their key, and the commit will still be accepted. Without a branch protection rule, compliance relies entirely on voluntary discipline.
- ✓
Enable 'Require signed commits' in the branch protection rules for the default branch.
Why this is correct
Enabling 'Require signed commits' in branch protection rules for the default branch enforces at the server level that every commit pushed to that branch must have a valid, verified signature. If a commit is unsigned or the signature cannot be verified, the push is rejected before the branch is updated. This is the correct, enforceable technical control.
- ✗
Use a GitHub Action that fails if commits are unsigned.
Why it's wrong here
A GitHub Action that fails on unsigned commits runs after the push has already been accepted and the commit exists in the repository, so it cannot block the push itself. The action can only report a failure after the fact, and while it could be used as a required status check, it still does not prevent the commit from being introduced. The enforcement must happen at the pre-receive level, which is exactly what branch protection rules provide.
Go deeper
Related to this question
Learn chapter
Designing a Security and Compliance Plan
Key term
Repository
A repository is a central storage location where software packages, code, or configuration files are kept, managed, and distributed for use by IT systems.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.