AZ-400 Develop a security and compliance plan Practice Question
Your team uses Azure Pipelines to deploy to production. You need to ensure that deployment only proceeds if a security scan passes and a manual approval is obtained. What is the best approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use release gates in release pipelines
Release gates in Azure Pipelines allow you to define automated checks (like security scans) and manual approvals before a deployment proceeds. Option A is incorrect because pipeline variables are used to store values, not to enforce deployment conditions. Option B is incorrect because service connections manage authentication to external services, not approval workflows. Option C is incorrect because branch policies apply to pull requests in repositories, not to release pipelines.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add pipeline variables
Why it's wrong here
Pipeline variables store key-value pairs that can be referenced during a run, but they are passive data and cannot enforce timing, approval, or environment conditions. To gate a production deployment, you need a mechanism that can evaluate health, compliance, or manual sign-off before the release proceeds.
- ✗
Set up service connections
Why it's wrong here
Service connections are authentication wrappers (e.g., Azure Resource Manager, GitHub, or custom endpoints) that allow Azure Pipelines to interact with external services. They do not provide any workflow control or conditional checks; they merely define credentials and target scope, so they cannot block or approve a production deployment.
- ✗
Configure branch policies
Why it's wrong here
Branch policies enforce pull request validation, build verification, and reviewer requirements on source branches. They operate on code changes before merging and do not execute in the deployment stage; therefore they cannot pre-check production release conditions or impose manual deployment approvals.
- ✓
Use release gates in release pipelines
Why this is correct
Release gates in Azure Pipelines run automated checks (e.g., querying work items, monitoring KPIs, or invoking Azure Monitor alerts) at a specified point in a release, and can pause the deployment until a condition is met. Combined with manual approval steps, release gates provide the necessary control to enforce compliance and quality before a production rollout begins.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Variables
A variable is a named storage location in a computer program that holds a value which can change during execution.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.