AZ-400 Develop a security and compliance plan Practice Question
Your team uses Azure Pipelines to deploy to multiple environments. The compliance team requires that all deployments to the production environment are approved by a security officer. Which feature should you use?
⚠ Common exam trap
It's easy for candidates to confuse environment-level approvals (which gate the deployment itself) with branch policies or secret management features, which address different compliance concerns like code review or credential access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure approvals and checks on the production environment in Azure Pipelines.
Approvals and checks in Azure Pipelines allow you to require manual approval before a deployment to a specific environment, such as production. By configuring an approval on the production environment, you ensure that a designated security officer must approve the deployment before it proceeds, meeting the compliance team's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure approvals and checks on the production environment in Azure Pipelines.
Why this is correct
Approvals and checks in Azure Pipelines environments allow you to require manual sign-off and/or automated gates (e.g., Azure Monitor alerts) before any deployment job targeting that environment runs. This is the native mechanism to gate deployments to production, providing control and auditability without affecting source control or artifact release processes.
- ✗
Create a branch policy that requires approval for pull requests.
Why it's wrong here
Branch policies govern code review and merge requirements for pull requests into a branch (e.g., main), not deployment activities. They cannot pause or block a pipeline stage that deploys to an environment, because deployments happen after code is merged and the pipeline runs independently of PR approval workflows.
- ✗
Use a service connection with a managed identity that requires approval.
Why it's wrong here
Service connections define authentication for connecting to Azure resources, but they do not have a built-in approval workflow to gate deployments. A managed identity authenticates safely, yet it does not pause a deployment for manual sign-off; approvals must be enforced at the environment or stage level via checks, not on the connection itself.
- ✗
Store the production credentials in a variable group with approval required.
Why it's wrong here
Variable groups can reference Azure Key Vault secrets and have library security settings, but they do not provide deployment approval gates. The "Approvals" feature in library only requires approval for accessing the variable group's contents, and it does not pause the deployment pipeline before it uses those credentials to deploy.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.