Question 119 of 823
Two Ways to Limit Who Can Approve a Production Release
Your release pipeline deploys to multiple environments (dev, test, prod). You need to ensure that only authorized users can approve production deployments. Which TWO actions should you take?
Quick Answer
Two controls need to work together: an Approval check on the production environment itself, and a pre-deployment approval on the production stage of the pipeline. Environment permissions only govern who can manage the environment, not who can sign off on a deployment to it, and deployment gates check automated health metrics rather than authorizing specific people.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a 'Approval' check on the production environment.
The correct actions to ensure only authorized users can approve production deployments are to add an 'Approval' check on the production environment (option D) and to add a pre-deployment approval to the production stage (option E). Both methods require explicit user approval before deployment proceeds. Option A is incorrect because a manual intervention task pauses the pipeline for interactive validation but does not enforce user authorization checks; it is typically used for prompts, not approval gates. Option B is incorrect because environment permissions control who can create releases or manage environments, not who can approve deployments to production—they manage access at a higher level. Option C is incorrect because deployment gates are automated health checks (e.g., monitoring metrics) that can block deployment based on conditions, but they do not handle user approval; approval is a separate check type.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a manual intervention task in the pipeline.
Why it's wrong here
Manual intervention is for pausing and waiting for input, not for approval control.
- ✗
Set environment permissions to allow only specific users to create releases.
Why it's wrong here
Release creation permissions don't control deployment approvals.
- ✗
Configure deployment gates to check for user approval.
Why it's wrong here
Gates evaluate health criteria, not user approvals.
- ✓
Add a 'Approval' check on the production environment.
Why this is correct
Checks can require approval from specific users or groups.
- ✓
Add a pre-deployment approval to the production stage.
Why this is correct
Pre-deployment approvals require designated approvers before deployment.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
8 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You have a multi-stage YAML pipeline that deploys to Azure App Service. The deployment to the production stage should only proceed if a manual approval is granted. How should you configure this?
medium- A.Use deployment gates with Azure Monitor metrics
- B.Configure branch policies on the main branch
- C.Add a pipeline decorator to require sign-off
- ✓ D.Add an approval check on the production environment
Why D: Azure Pipelines supports approval checks on environments, which allow you to require manual approval before a deployment proceeds to a specific stage. By adding an approval check on the production environment, the pipeline will pause at that stage until an authorized user grants approval, meeting the requirement for manual sign-off before production deployment.
Variation 2. You need to ensure that only approved users can deploy to production from Azure Pipelines. What should you implement?
easy- A.Pipeline approval gates
- B.Microsoft Entra ID Conditional Access policies
- ✓ C.Environment checks with required approvers
- D.Branch protection rules in GitHub
Why C: Azure Pipelines environment checks with required approvers allow you to enforce that only specific users or groups can approve deployments to a production environment. This is a native Azure DevOps feature that integrates with pipeline stages to gate deployments based on manual approval, ensuring that unauthorized users cannot trigger or approve production releases.
Variation 3. Your release pipeline deploys to multiple environments sequentially: Dev, QA, Staging, Production. You need to implement manual approval gates before Staging and Production deployments. Which TWO configurations should you use? (Choose two.)
medium- A.Add a post-deployment approval gate to the Dev and QA stages.
- ✓ B.Use the 'Approvals and gates' settings in the release pipeline stage.
- C.Configure branch policy on the release branch to require approvals.
- D.Add a 'Manual Validation' task in the YAML pipeline.
- ✓ E.Add a pre-deployment approval gate to the Staging and Production stages.
Why B: The 'Approvals and gates' settings in a release pipeline stage allow you to configure pre-deployment approvals, which require designated users to approve the deployment before it proceeds. This is the standard mechanism in Azure DevOps for implementing manual approval gates. Option E is correct because adding a pre-deployment approval gate specifically to the Staging and Production stages ensures that deployments to these environments are blocked until the required approvals are granted, meeting the requirement for manual approval before Staging and Production.
Variation 4. Your Azure Pipelines release pipeline deploys to multiple stages. You need to implement a manual approval gate that requires two specific users to approve before deployment proceeds to production. The approval should expire after 8 hours. Which configuration should you use?
hard- ✓ A.Pre-deployment conditions: Add approvers (user1, user2) with 'All' policy and set timeout to 480 minutes
- B.Pre-deployment conditions: Add approvers (user1, user2) with 'Any one' policy
- C.Pre-deployment conditions: Add approvers (user1, user2) with 'All' policy and set 'Allow deployment without approval' to true
- D.Post-deployment conditions: Add approvers (team) with 'All' policy
Why A: It configures a pre-deployment approval gate requiring both user1 and user2 to approve (the 'All' policy) before the production stage proceeds, and sets the timeout to 480 minutes (8 hours) to expire the approval request. This matches the requirement for two specific users to approve and an 8-hour expiration.
Variation 5. Your team is adopting Azure Pipelines for a new project. You need to ensure that only authorized users can approve releases to production. Which two methods can you use to implement approval checks?
medium- ✓ A.Configure pre-deployment approvals on the Production environment.
- B.Use Deployment Gates with a manual approval gate.
- ✓ C.Set the 'Required approvers' field on the environment to a specific user or group.
- D.Add a Manual Intervention task in the release pipeline.
- E.Add an Approval Check to the agent pool.
Why A: Pre-deployment approvals on the Production environment (Option A) allow you to require one or more users or groups to approve a release before it is deployed to that environment. Similarly, setting the 'Required approvers' field on the environment (Option C) specifies the users or groups that must approve the deployment, which is another native Azure Pipelines approval mechanism. Both enforce authorization at the environment level, ensuring only designated approvers can promote a release to production.
Variation 6. You are configuring a release pipeline in Azure DevOps to deploy to multiple environments (dev, test, prod). You need to ensure that the production deployment requires manual approval from the release manager. What should you configure?
easy- ✓ A.Set pre-deployment approvals on the production stage.
- B.Add a manual intervention task before the production deployment.
- C.Set post-deployment approvals on the test stage.
- D.Use a condition on the production stage to check a variable.
Why A: Pre-deployment approvals on the production stage enforce manual sign-off before any deployment to that environment begins. This ensures the release manager must explicitly approve the deployment, meeting the requirement for manual approval on production. Azure DevOps stages support pre-deployment and post-deployment approval gates, with pre-deployment being the correct choice for controlling when a stage starts.
Variation 7. You are designing a release pipeline for a .NET application. The pipeline must deploy to multiple environments (Dev, Test, Prod) with manual approval at each stage. Which release trigger should you configure for the production stage?
easy- A.Pull request trigger from the main branch.
- B.Continuous deployment trigger after a successful build.
- ✓ C.Manual trigger with pre-deployment approvals.
- D.Scheduled trigger set to run nightly.
Why C: The requirement specifies manual approval at each stage, and for the production stage, a manual trigger with pre-deployment approvals ensures that deployments only occur after explicit human authorization. This aligns with the need for controlled, gated releases to production, preventing automatic or scheduled deployments that bypass approval.
Variation 8. You are configuring a release pipeline that deploys to multiple environments. You want to automate the deployment to the staging environment only if the build succeeds, and then require manual approval before deploying to production. Which strategy should you use?
medium- ✓ A.Define an environment with approvals required for the production stage.
- B.Use deployment gates in the production stage to check for manual intervention.
- C.Use a classic release pipeline with pre-deployment approvals.
- D.Configure a branch policy on the main branch to require approval for pull requests.
Why A: Azure Pipelines allows you to define environments with explicit approval checks. By adding a manual approval gate on the production environment stage, the pipeline will automatically deploy to staging after a successful build, but pause before production until an authorized user approves the release. This directly meets the requirement for automated staging deployment and manual production approval.
Last reviewed: Jun 20, 2026
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.