AZ-400 Develop a security and compliance plan Practice Question
Your organization requires that all code changes be signed using a valid code signing certificate before they can be merged. Which feature in GitHub should you enable to enforce this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Commit signature verification.
Commit signature verification in GitHub enforces that commits are signed with a verified GPG or S/MIME key, which meets the requirement of signing code changes. Option A is wrong because Dependabot handles dependency updates, not signature enforcement. Option C is wrong because code scanning analyzes code for vulnerabilities, not for commit signatures. Option D is wrong because secret scanning detects secrets in repositories, not signature enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dependabot.
Why it's wrong here
Dependabot is a tool for automated dependency updates, creating pull requests when newer versions of libraries are available. It does not enforce or verify commit signatures, so while it helps keep dependencies patched, it cannot meet a requirement for signing all code changes.
- ✓
Commit signature verification.
Why this is correct
Commit signature verification requires each commit to be cryptographically signed with a verified key (e.g., GPG, SSH, or S/MIME) and the signature to be verified by the repository host. Enabling this in Azure Repos or GitHub protects the integrity and authenticity of every change, directly ensuring that all code changes are signed.
- ✗
Code scanning.
Why it's wrong here
Code scanning analyzes source code for security vulnerabilities and coding errors using static analysis, often integrated with CI/CD. It does not check commit signatures or enforce signing policy, so it cannot address a requirement that all code changes be signed.
- ✗
Secret scanning.
Why it's wrong here
Secret scanning looks for sensitive information such as API keys, tokens, and connection strings that are accidentally committed to a repository. It is a security control for preventing credential leakage, but it has no role in enforcing or verifying commit signatures, making it irrelevant to this requirement.
Go deeper
Related to this question
Learn chapter
Managing Infrastructure as Code Using Azure
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.