AZ-400 Practice Question: Design and implement build and release pipelines
Your team uses Azure Pipelines for CI/CD. You need to ensure that only approved branches can trigger production deployments. Which feature should you use?
⚠ Common exam trap
Watch out — candidates often confuse deployment gates (approval checks) with branch-level access control, but gates evaluate conditions during deployment, not which branches are allowed to trigger the deployment in the first place.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Branch control for environments
Branch control for environments in Azure Pipelines allows you to restrict which branches can trigger deployments to specific environments, such as production. By configuring branch filters on an environment, you ensure that only approved branches (e.g., main or release branches) can initiate a production deployment, providing a security and governance boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
YAML template expressions
Why it's wrong here
YAML template expressions evaluate pipeline definition logic at compile time (e.g., conditions, loops, parameterization), but they do not enforce branch-level permissions. Branch restrictions for deployments are configured separately in environment checks, not via template expressions.
- ✓
Branch control for environments
Why this is correct
Branch control for environments is the correct answer because Azure Pipelines environment checks allow you to restrict which branches or branch types can deploy to that environment. This is done by configuring an approval or branch control check that references an allowed branch list or a required template, thereby enforcing that only authorized branches trigger releases.
- ✗
Deployment gates
Why it's wrong here
Deployment gates are health or quality checks (e.g., work item queries, Azure Monitor alerts) that run as pre-deployment or post-deployment conditions, but they do not restrict which branches can start a deployment. They evaluate telemetry or approval criteria after a deployment is initiated, whereas branch control determines if a branch is permitted to deploy at all.
- ✗
Pipeline decorators
Why it's wrong here
Pipeline decorators are custom extensions that automatically inject steps into every pipeline run, but they cannot enforce branch permissions. They are used to add consistent tasks like security scans or logging, not to block deployments based on the source branch, which is handled by environment branch control checks.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.