AZ-400 Develop a security and compliance plan Practice Question
Your organization uses Microsoft Entra ID for identity and Azure DevOps for source control. You need to enforce that all code changes to the main branch require a pull request with at least two approvals and no failing checks. What should you configure?
⚠ Common exam trap
Many exam-takers confuse environment protection rules (used for deployment approvals in release pipelines) with branch policies (used for source code merge requirements in Azure Repos), leading them to select Option B instead of C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up a branch policy on the main branch in Azure Repos
Azure Repos branch policies allow you to enforce required pull requests, minimum number of reviewers (e.g., two approvals), and status checks (e.g., no failing checks) on the main branch. This ensures that all code changes to the protected branch comply with the defined quality and security gates before merging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a Conditional Access policy in Microsoft Entra ID
Why it's wrong here
Conditional Access policies operate on authentication and session risk for cloud apps, enforcing MFA, device compliance, or location restrictions — they have no mechanism to require code reviews or gate pull request merges in Azure Repos.
- ✗
Add an environment protection rule in Azure Pipelines
Why it's wrong here
Environment protection rules control when a pipeline can deploy to a specific environment (e.g., approvals, checks, or required templates) and apply to release stages, not to branch policies or pull request reviewers on the main branch.
- ✓
Set up a branch policy on the main branch in Azure Repos
Why this is correct
Branch policies in Azure Repos provide a server-enforced compliance gate on pull requests targeting the main branch. You can configure a policy to require a minimum number of reviewers, enforce build validation by running a pipeline, and mandate linked work items. These policies block direct pushes to the main branch and prevent pull request completion until every defined criterion is satisfied, making them an authoritative mechanism for code review and build quality gates.
- ✗
Use a service hook to notify reviewers when a push occurs
Why it's wrong here
Service hooks can raise notifications or trigger external systems when a push occurs, but they are fire-and-forget events and cannot enforce a minimum number of reviewers or block a merge — they provide no compliance gate.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
Key term
Pull request
A pull request is a way for a developer to propose changes to a codebase and ask other team members to review and merge them into the main project.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.