AZ-400 Configure processes and communications Practice Question
Your organization uses GitHub Enterprise and requires that all commits to the main branch are signed with a GPG key verified by your organization. Developers are getting errors when pushing signed commits. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently confuse authentication (SSH keys) with signing (GPG keys) or assume email mismatch is the primary cause, when in fact the core issue is the absence or unverified status of the GPG key itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The developer's GPG key is not uploaded to their GitHub account or not verified.
GitHub requires that the GPG key used to sign a commit be uploaded to the user's GitHub account and marked as verified. If the key is missing or unverified, GitHub cannot confirm the signature's authenticity, causing the push to be rejected when branch protection rules enforce signed commits.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The branch protection rule requires a linear history.
Why it's wrong here
Enforcing a linear history via a branch protection rule only prevents merge commits and encourages rebasing or squashing; it does not interact with Git's signature verification mechanism, so it cannot cause a commit to appear unverified.
- ✓
The developer's GPG key is not uploaded to their GitHub account or not verified.
Why this is correct
GitHub marks a commit as verified only when the signature was made by a GPG key that is uploaded to the user's GitHub account and associated with a verified email matching the commit's author. If the key is missing or not yet verified (e.g., the email is unconfirmed), GitHub cannot confirm the signature's authenticity, resulting in an unverified status.
- ✗
The developer's email in the commit does not match any email on their GitHub account.
Why it's wrong here
While the commit email must match a verified email on the GitHub account for a signature to be recognized, this is not the primary cause here. A mismatched email only prevents verification if a valid GPG public key is already uploaded and that email isn't linked to it. In the typical scenario where commits appear unverified, the developer has not set up commit signing at all—no GPG key exists in Git config, and no public key is uploaded to GitHub. Thus, the absence of a GPG key is the root cause; email mismatch is a secondary, less likely condition that presupposes the key is present.
- ✗
The developer's SSH key is not added to their GitHub account.
Why it's wrong here
SSH keys are only used for authenticating network connections to GitHub (e.g., git over SSH), whereas commit signing relies on GPG keys. Adding or omitting an SSH key has no bearing on whether a GPG signature is recognized, so this is not the cause of the missing verification.
Go deeper
Related to this question
Learn chapter
Designing a Release Pipeline
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.