AZ-400 Develop a security and compliance plan Practice Question
Your organization uses Azure DevOps and requires that all pipelines enforce branch policy for pull requests. A developer creates a pipeline that builds and tests code on push to any branch. The security team wants to ensure that no code can be deployed to production without passing through a pull request with required reviewers. Which action should you take to meet this requirement?
⚠ Common exam trap
It's easy for candidates to confuse pipeline-level approvals (like pre-deployment gates) with branch policies, which are the correct mechanism to enforce pull request workflows at the source control level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure branch policy on the main branch to require a pull request with a minimum number of reviewers.
Azure DevOps branch policies enforce that all changes to the main branch must go through a pull request with required reviewers. This ensures no code can be deployed to production without passing through the defined review process, meeting the security team's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable CI triggers on the pipeline and require manual builds.
Why it's wrong here
Disabling CI triggers only prevents automated builds from starting on commits/pushes; it does not prevent developers from directly pushing to the main branch or merging changes without a pull request. Azure DevOps branch policies (not pipeline triggers) are the control that enforces required PR reviews before merge.
- ✗
Modify the service connection to require admin approval.
Why it's wrong here
Service connection approvals control who can use a configured Azure service connection (e.g., for deployments) and require admin approval for pipeline use; they have no effect on code review requirements or pull request policies, so they cannot enforce peer review prior to merging changes.
- ✗
Set the pipeline to require approval from the security team before running.
Why it's wrong here
Pipeline approvals (e.g., environment approval gates) are checks applied before or after a pipeline stage runs, such as pre-deployment approvals from the security team; they do not inspect or approve the actual code changes in a PR and do not prevent direct pushes or non-reviewed merges to the main branch.
- ✓
Configure branch policy on the main branch to require a pull request with a minimum number of reviewers.
Why this is correct
Branch policies on the main branch are the correct Azure DevOps mechanism to enforce pull request requirements, including a minimum number of reviewers; once configured, any update to the main branch must go through a PR that meets the required reviewer count, preventing unreviewed changes from being merged.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
Key term
Pull request
A pull request is a way for a developer to propose changes to a codebase and ask other team members to review and merge them into the main project.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.