AZ-400 Practice Question: Design and implement build and release pipelines
Your organization is adopting GitHub Actions for CI/CD. You need to enforce that all workflows must pass required status checks before merging pull requests to the main branch. The repository is in an organization. What should you configure?
⚠ Common exam trap
Many exam-takers confuse branch protection rules (which enforce merge requirements) with environment protection rules (which control deployment approvals) or CODEOWNERS (which mandate file-level reviews), leading candidates to pick options that address review or permissions rather than status checks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a branch protection rule for the main branch with required status checks.
Branch protection rules in GitHub allow you to enforce required status checks on pull requests before merging. By configuring a branch protection rule for the main branch, you can specify that certain GitHub Actions workflow runs must pass (e.g., CI checks) before a pull request can be merged. This directly enforces the policy that all workflows must pass required status checks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add an environment protection rule requiring approval from specific reviewers.
Why it's wrong here
Environment protection rules apply to deployment environments, not to branch merge policies. They can mandate reviewers for production deployments, but they do not block merging a pull request into main. To enforce checks before merge, you must use branch protection rules on the repository.
- ✗
Set the workflow to have 'contents: write' permission.
Why it's wrong here
Setting `contents: write` in a workflow grants the GITHUB_TOKEN permission to modify repository contents, such as pushing commits or tags, but it does not create any merge requirements or status checks. Merge gates are defined by branch protection rules, not by workflow permissions.
- ✗
Define a CODEOWNERS file that requires team review for main branch changes.
Why it's wrong here
A CODEOWNERS file can require reviews from specified teams for changes to certain paths, but it does not function as a status check. Required status checks, which must pass before merging, are enforced via branch protection rules, whereas CODEOWNERS only adds review requirements.
- ✓
Create a branch protection rule for the main branch with required status checks.
Why this is correct
Creating a branch protection rule for the main branch with required status checks is the correct solution because it prevents merging until the specified GitHub Actions workflow checks succeed. This enforces CI/CD validation as a hard gate for all pull requests targeting main, ensuring only verified changes are merged.
Go deeper
Related to this question
Learn chapter
Planning for DevOps Transformation
Key term
Repository
A repository is a central storage location where software packages, code, or configuration files are kept, managed, and distributed for use by IT systems.
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.