Courseiva
← AZ-400
Full test
Design and implement a source control strategy →hardMultiple ChoiceObjective-mapped

AZ-400 Practice Question: Design and implement a source control strategy

Your company uses GitHub for source control. The security team requires that all commits to the main branch be signed with an approved GPG key. Additionally, developers must use their corporate email for commits. You need to configure branch protection rules and repository settings to enforce these requirements. Which combination of settings should you use?

⚠ Common exam trap

Test-takers frequently assume 'Require signed commits' alone enforces both signature and email domain, but it only ensures the commit is signed with a verified GPG key—it does not restrict the email domain, so an additional status check is needed.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable 'Require signed commits' in branch protection and use a required status check that runs a custom action to verify commit author email.

GitHub branch protection rules can require signed commits, but they only verify that a commit is signed with any GPG key, not that the signer's email matches a corporate domain. To enforce the corporate email requirement, you must add a required status check that runs a custom action (e.g., using `actions-ecosystem/action-check-commit-email`) to verify the commit author email matches the corporate domain. This combination satisfies both the GPG signature and email domain requirements.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Configure repository to require commit signature verification via SSH keys.

    Why it's wrong here

    GitHub only supports commit signature verification using GPG or S/MIME keys; SSH keys are for authentication only, not for signing commits. Therefore, requiring commit signatures via SSH keys is not supported and cannot be enforced.

  • ✗

    Enable 'Require signed commits' in branch protection rules and use a pre-receive hook to validate email domain.

    Why it's wrong here

    Branch protection's 'Require signed commits' setting is available on GitHub.com, but pre-receive hooks are not: they exist only on GitHub Enterprise Server, where an administrator installs and configures them at the instance level. On GitHub.com, there is no pre-receive hook mechanism exposed to repositories, so the email-domain validation half of this option cannot be implemented. Even though a pre-receive hook would run before a push is accepted, its unavailability on GitHub.com makes this combination unworkable; a required status check running a GitHub Action is the supported alternative.

  • ✗

    Use a GitHub Actions workflow that checks commit signatures and email and rejects if invalid.

    Why it's wrong here

    GitHub Actions workflows run after a push has already been accepted, so they cannot reject the push itself. While a workflow can report a failing status check, it cannot prevent the commit from entering the repository history.

  • ✓

    Enable 'Require signed commits' in branch protection and use a required status check that runs a custom action to verify commit author email.

    Why this is correct

    Branch protection rules can require signed commits, and a required status check can run a custom GitHub Action that verifies the commit author's email against an allowed domain. This combination successfully enforces both signature and email constraints during pulls.

About these practice questions

One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.