AZ-400 Practice Question: Design and implement a source control strategy
Your organization uses Azure Repos and requires that all code changes pass a security scan before merging. The scan is run as a build validation policy. However, the scan takes 30 minutes and developers often bypass it by pushing directly to main. How can you enforce the policy for all changes?
⚠ Common exam trap
Many exam-takers think a service hook or simply disabling direct pushes is sufficient, but they fail to recognize that only a branch policy with a required build validation can enforce the scan as a gate for all changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set a branch policy on main that requires a build validation with the security scan
Setting a branch policy on main that requires a build validation with the security scan enforces the scan as a mandatory gate for all pull requests targeting main. This prevents developers from bypassing the scan by pushing directly, as the policy blocks direct pushes and only allows changes through pull requests that must pass the configured build validation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Turn off direct push permissions for all users and force all changes through pull requests
Why it's wrong here
Turning off direct push permissions and requiring all changes to go through pull requests ensures that changes enter main via PRs, but it does not by itself execute or enforce the security scan. In Azure DevOps, a pull request can be completed without any automated validation unless a branch policy explicitly requires build validation; without that policy, developers could complete PRs that bypass the scan. Branch policies, not permissions alone, are the mechanism that makes the security scan a mandatory gate for merging into main.
- ✗
Delete the main branch and recreate it as a protected branch
Why it's wrong here
Deleting the main branch is disruptive, destroys history, and does not create any actual branch protection; in Azure DevOps, protecting a branch is achieved by configuring branch policies on an existing branch. Without a branch policy that requires build validation, a recreated main branch would still allow changes to be merged without the security scan, so this approach fails to enforce the requirement.
- ✓
Set a branch policy on main that requires a build validation with the security scan
Why this is correct
Setting a branch policy on main that requires a build validation is the correct approach because Azure DevOps will run the specified security scan pipeline for every pull request targeting main and block the merge if the scan fails. Additionally, branch policies enforce the scan on every push to main and prevent bypasses, ensuring all code that enters the protected branch has passed the mandatory security validation.
- ✗
Use a service hook to run the scan on every push to main
Why it's wrong here
Service hooks are asynchronous and event-driven, meaning they fire after a push to main has already occurred, so they can never block a push or merge if the scan fails. They are useful for notifications or triggering after-the-fact actions but do not provide a pre-merge gate; only a branch policy with build validation can enforce that the security scan must pass before code is merged into main.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Branch policy
A branch policy is a set of rules and conditions enforced on a Git branch to control how code changes are proposed, reviewed, and merged, ensuring code quality and protecting critical branches.
Key term
Azure Repos
Azure Repos is a set of version control tools that allow teams to manage their source code, track changes, and collaborate on software projects using Git or Team Foundation Version Control (TFVC) within the Microsoft Azure ecosystem.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.