Develop a security and compliance plan →mediumMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Your team uses Azure DevOps and wants to enforce branch protection policies for all repositories in a GitHub Advanced Security-enabled organization. Which approach should you use to ensure that pull requests require a successful status check from a required workflow?

⚠ Common exam trap

Candidates may confuse Azure DevOps branch policies (which apply to Azure Repos) with GitHub repository rules. Option D is incorrect because Azure DevOps branch policies do not apply to GitHub repositories, even if the organization uses Azure DevOps.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Define a repository rule in GitHub that requires a successful status check from a required workflow.

GitHub repository rules (also known as repository rulesets) allow organizations to centrally enforce policies like required status checks across multiple repositories. To require a successful status check from a specific workflow on all pull requests, create an organization-level repository ruleset that includes the 'Require status checks to pass' rule and specify the workflow's check name. This applies to all selected repositories without per-repository configuration. GitHub Advanced Security is not required for this feature; it is a separate security add-on.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use GitHub Actions secrets to store the required status check name.
Why it's wrong here
GitHub Actions secrets are encrypted variables designed to safely store sensitive data like tokens and credentials; they are not evaluated as policy by GitHub's branch protection engine. Storing a status check name inside a secret does not cause any branch or repository rule to be enforced, since required status checks must be configured through protected branch or repository rules.
✓
Define a repository rule in GitHub that requires a successful status check from a required workflow.
Why this is correct
Repository rules (the modern replacement for individual protected branch settings) let you centrally define branch protection policies for all repositories in an organization. By creating a rule that requires a successful status check named after a required workflow, you enforce that check across every matching branch and repository, making it the correct organization-wide solution for this requirement.
✗
Create a branch protection rule in each repository's settings.
Why it's wrong here
While possible, this is not scalable and does not enforce organization-wide policies; repository rules are preferred.
✗
Configure branch policies in Azure DevOps project settings.
Why it's wrong here
Azure DevOps branch policies are scoped to Git repositories hosted in Azure Repos and enforce checks within that system, such as build validation, reviewers, and work item linking. They do not interact with GitHub's pull request or status check APIs, so configuring them in Azure DevOps project settings would have no effect on a GitHub-based repository, making this option ineffective for the stated requirement.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question