AZ-400 Configure processes and communications Practice Question
Your organization uses GitHub and wants to enforce that all commits to the main branch are signed with a GPG key that is verified against the user's GitHub account. Additionally, you want to block unsigned commits even if the committer is a repository admin. Which configuration should you use?
⚠ Common exam trap
It's easy for candidates to confuse 'Include administrators' with a separate setting or assume that admins are always exempt, leading them to choose Option B, but the question explicitly requires blocking unsigned commits for all users including admins, so 'Include administrators' must be set to true.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Require signed commits' and set 'Include administrators' to true.
Enabling 'Require signed commits' in a GitHub branch protection rule, combined with setting 'Include administrators' to true, enforces that every commit pushed to the protected branch must be signed with a GPG key verified against the user's GitHub account, and this restriction applies even to repository administrators. This configuration blocks unsigned commits entirely, meeting the requirement to enforce signing for all users including admins.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a pre-receive hook that rejects unsigned commits.
Why it's wrong here
Pre-receive hooks are a server-side feature supported only on GitHub Enterprise Server, not on github.com. On GitHub.com, you cannot add or configure pre-receive hooks because the underlying infrastructure is managed by GitHub, and hook execution would pose a security and availability risk. Therefore, this option is not a valid enforcement mechanism for organizations using GitHub.com, even though it might work in a self-hosted Enterprise Server environment.
- ✗
Enable 'Require signed commits' and set 'Include administrators' to false.
Why it's wrong here
Enabling 'Require signed commits' with 'Include administrators' set to false leaves an administrative bypass in the branch protection rule, allowing admins to push unsigned commits. Since the organization requires every commit to be signed, this exception contradicts the policy and does not fully enforce the requirement.
- ✓
Enable 'Require signed commits' and set 'Include administrators' to true.
Why this is correct
Enabling 'Require signed commits' with 'Include administrators' set to true ensures that every commit pushed to the protected branch must have a valid signature, regardless of the pusher's role. This branch protection setting applies to all users, including repository administrators, thereby meeting the organization's goal of enforcing signed commits across the board on GitHub.com.
- ✗
Enable 'Require signed commits' and configure web commit signing.
Why it's wrong here
Web commit signing automatically signs commits that are created through the GitHub web interface, such as edits made directly in the browser or merges performed via the web. However, it does not affect commits pushed from a local Git client using the command line or another Git tool, so developers could still push unsigned commits to the repository. To enforce signing for all commits, you must use a branch protection rule with 'Require signed commits' enabled, which validates every pushed commit regardless of its origin.
Go deeper
Related to this question
Learn chapter
Managing Azure DevOps Processes and Communications
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
Key term
Repository
A repository is a central storage location where software packages, code, or configuration files are kept, managed, and distributed for use by IT systems.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.