AZ-400 Develop a security and compliance plan Practice Question
Your team uses Azure Pipelines to deploy to multiple environments. You need to ensure that deployment to the production environment requires approval from the security team. What should you configure?
⚠ Common exam trap
Many candidates confuse branch policies (which govern code changes) with environment approval checks (which govern deployment gates), leading candidates to incorrectly select a branch policy for deployment control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an environment approval check for the production environment
Environment approval checks in Azure Pipelines allow you to require manual approval before a deployment proceeds to a specific environment, such as production. By adding an approval check to the production environment, you ensure that the security team must explicitly approve the deployment, meeting the requirement without modifying the pipeline code or branch policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a branch policy to the production branch
Why it's wrong here
Branch policies govern pull request workflows by requiring reviewers, builds, or linked work items before merging code; they do not create a manual approval gate after the merge, so a production deployment can still run unattended once the PR is completed. Thus, this option does not satisfy the requirement for explicit human sign-off on a deployment.
- ✓
Add an environment approval check for the production environment
Why this is correct
An environment approval check adds a required manual approval step before any jobs targeting that environment are executed. The pipeline pauses, and only after an authorized user or group explicitly approves the deployment does it proceed to the production stage, directly fulfilling the need for human sign-off on production deployments.
- ✗
Use a condition in the YAML pipeline to check a variable
Why it's wrong here
YAML conditions are evaluated automatically at runtime based on variables, parameters, or prior job outcomes, and they either skip or execute a step without any interactive involvement. Because they cannot wait for a designated person to review and approve the release, this option is not a valid way to add a manual approval gate.
- ✗
Configure a service connection with restricted permissions
Why it's wrong here
Service connections store credentials and grant the pipeline permission to access Azure resources, but they are only an authentication/authorization mechanism. They do not insert a human review step into the execution flow, so a tightly scoped connection alone cannot pause a deployment and require manual approval before production is updated.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.