AZ-400 Practice Question: Design and implement build and release pipelines
Your organization is adopting GitHub Actions for CI/CD. You need to ensure that only approved actions from your enterprise can be used in workflows. What should you configure?
⚠ Common exam trap
Many candidates confuse repository-level permissions (which do not have a 'restrict by creator' option) with enterprise-level policies, leading them to select Option C, which sounds plausible but is not a valid configuration in GitHub.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the enterprise policy to 'Allow only specific actions' and add approved actions.
GitHub Enterprise allows administrators to restrict which actions can be used in workflows by setting the enterprise policy to 'Allow only specific actions' and then explicitly approving a curated list of actions. This ensures that only trusted, pre-approved actions (e.g., from verified publishers or your own organization) can be referenced, preventing the execution of unapproved or malicious actions. This policy is enforced at the enterprise level and applies to all repositories within the enterprise, providing centralized control over CI/CD supply chain security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a third-party tool to scan workflows for disallowed actions after each commit.
Why it's wrong here
Scanning workflows with a third-party tool after each commit is reactive, not proactive, enforcement. It only detects violations after the workflow has already run, which could allow disallowed actions to execute and potentially compromise secrets before the scan flags them, so it does not prevent the misuse in the first place.
- ✗
Set the enterprise policy to 'Allow all actions' and rely on code review.
Why it's wrong here
Setting the enterprise policy to 'Allow all actions' and relying on code review permits any action from any source, including unverified or malicious third-party actions. Code review is inconsistent and does not provide runtime enforcement, so insecure or disallowed actions could run in production workflows outside of the review process.
- ✗
Configure repository permissions to restrict actions to only those created by your organization.
Why it's wrong here
Configuring repository permissions to restrict actions to only those created by your organization is scoped per repository and does not provide enterprise-wide enforcement. It also does not align with a curated allowlist, as it blocks all external actions and can break workflows that legitimately use approved actions from other organizations.
- ✓
Set the enterprise policy to 'Allow only specific actions' and add approved actions.
Why this is correct
Setting the enterprise policy to 'Allow only specific actions' and adding approved actions is the correct approach because it enforces centrally across every repository in the enterprise. This proactive policy ensures that only vetted, approved actions from the allowlist can be used, preventing disallowed actions from ever running in the CI/CD pipeline.
Go deeper
Related to this question
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.