Using a Pre-Deployment Approval Gate as Documented Change Management Evidence
Your team uses Azure DevOps and wants to implement a change management process where all production releases must be approved by a change advisory board (CAB) after the build is complete but before deployment. The approval must be recorded in the pipeline. What is the best approach?
Quick Answer
A release pipeline with a pre-deployment approval gate on the production stage is what gives you a recorded, auditable CAB sign-off — the designated approver (or the CAB group) has to explicitly approve before deployment proceeds, and that approval is captured in the pipeline's own audit trail, satisfying the documentation requirement.
⚠ Common exam trap
Candidates often confuse manual intervention tasks (Option B) with formal approval gates, not realizing that manual intervention lacks the built-in approval recording and multi-approver workflow required for CAB sign-off in a change management process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a release pipeline with a pre-deployment approval gate for the production stage.
A release pipeline with a pre-deployment approval gate for the production stage enforces that a designated approver (or group, such as the CAB) must approve the release before deployment begins. The approval is recorded in the pipeline's audit trail, satisfying the requirement for documented change management. This approach aligns with Azure DevOps release management best practices for gating production deployments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a branch policy requiring CAB member approval on pull requests.
Why it's wrong here
Branch policies apply to code changes, not deployment approvals.
- ✗
Add a manual intervention task in the YAML pipeline.
Why it's wrong here
Manual intervention tasks are less integrated and may not provide proper audit trails.
- ✗
Set up a service hook to send an email to the CAB and wait for a reply.
Why it's wrong here
Service hooks can notify but do not enforce approval within the pipeline.
- ✓
Create a release pipeline with a pre-deployment approval gate for the production stage.
Why this is correct
Pre-deployment approvals allow designated approvers to approve before deployment, with full audit trail.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Approval gate
An approval gate is a checkpoint in an Azure DevOps release pipeline where a pipeline run pauses until a designated team or person manually approves or rejects the deployment.
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization uses Azure DevOps and wants to implement a change management process where all changes to the main branch require approval from a change advisory board (CAB). The CAB members are not part of the development team. How should they configure this?
hard- A.Set branch permissions to restrict push to main and only allow CAB to approve via manual process.
- ✓ B.Create a new branch policy on main that requires a minimum number of reviewers from a separate CAB group.
- C.Use a service hook to notify CAB when a PR is created, and rely on manual approval.
- D.Add the CAB as members of the development team and require team review.
Why B: Azure DevOps branch policies allow you to enforce a minimum number of reviewers from a specific security group (e.g., a CAB group) on pull requests targeting the main branch. This ensures that every change to main requires explicit approval from CAB members, who are separate from the development team, without relying on manual processes or altering team membership.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.