Two Tools That Enforce Branch Protection Policies on GitHub Repositories

Your organization uses GitHub and wants to implement a policy that requires all pull requests to be approved by at least two members of the 'security-team' team before merging. The 'security-team' team is a child team of 'engineering'. Which branch protection rule setting should you use?

Quick Answer

'Require pull request reviews before merging' with the security team set as required reviewers, and the required-reviewer count set to two, is what actually enforces this — a CODEOWNERS file only scopes reviews to specific file paths the team owns, not every pull request, so it doesn't cover the broader policy on its own.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use the 'Require pull request reviews before merging' rule and set 'Required reviewers' to the security team.

'Require pull request reviews before merging' with 'Required reviewers' set to the security team. This configuration enables branch protection to enforce reviews from that specific team. To require approval from at least two members, you must also set the 'Required number of reviewers' to 2 within the same branch protection rule. Option A is unrelated to reviewer requirements. Option C only sets a minimum number of reviewers without specifying which team, so it could allow any approver. Option D requires a CODEOWNERS file and only applies to file patterns owned by the team, not all pull requests. Therefore, B is the foundational setting needed to achieve the policy.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enable 'Dismiss stale pull request approvals when new commits are pushed'.
Why it's wrong here
This does not enforce reviewer composition.
✓
Use the 'Require pull request reviews before merging' rule and set 'Required reviewers' to the security team.
Why this is correct
This enforces approval from two members of the specified team.
✗
Require a minimum number of reviewers and set it to 2.
Why it's wrong here
This requires any two reviewers, not specifically from security team.
✗
Require code owner review and add the security team as code owners.
Why it's wrong here
Code owner review requires one approval from any owner, not necessarily two from security team.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on AZ-400

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Your team uses GitHub Flow and wants to ensure that every pull request is reviewed by at least one team member. Which branch protection rule should you enable?

easy

✓ A.Require a pull request before merging and set required number of reviewers to 1
B.Require signed commits
C.Require status checks to pass before merging
D.Require conversation resolution before merging

Why A: GitHub Flow relies on pull requests for collaboration, and the 'Require a pull request before merging' rule with a required number of reviewers set to 1 enforces that every PR must be reviewed by at least one team member before it can be merged. This directly satisfies the requirement of ensuring code review for all changes.

Last reviewed: Jun 20, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.