AZ-400 Practice Question: Design and implement a source control strategy
Your team uses Azure Repos and needs to prevent secrets from being committed to the repository. Which built-in feature should you enable?
⚠ Common exam trap
Watch out — candidates often confuse client-side pre-commit hooks (Option C) with a built-in server-side solution, overlooking that hooks can be bypassed and are not enforced, while push protection in Azure Repos is a native, unbypassable guard.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable push protection in Azure Repos
Push protection in Azure Repos is a built-in feature that scans commits for high-confidence secrets (e.g., Azure service connection strings, SSH keys, and other credential patterns) and blocks the push if a secret is detected. This prevents secrets from ever reaching the remote repository, enforcing security at the server side without requiring client-side configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable GitHub secret scanning
Why it's wrong here
GitHub secret scanning is a service for repositories hosted on GitHub.com or GitHub Enterprise, not for Azure Repos. Since the team uses Azure Repos, this tool cannot scan their commits or block secrets, making it ineffective for their environment.
- ✗
Enable Azure Policy to scan repositories
Why it's wrong here
Azure Policy can enforce and audit resource configurations across Azure subscriptions, but it does not scan the contents of Git repositories or intercept commits. It operates at the Azure resource management layer, not on source code, so it cannot prevent secrets from being committed in Azure Repos.
- ✗
Configure a pre-commit hook with a secret scanning tool
Why it's wrong here
A pre-commit hook runs client-side in each developer's local environment and is not enforced server-side; developers can bypass it with --no-verify or by not installing it. While it can scan for secrets, it is not a built-in Azure Repos feature and does not provide centralized, guaranteed protection across all teams.
- ✓
Enable push protection in Azure Repos
Why this is correct
Push protection in Azure Repos is a built-in server-side feature that scans incoming commits for known secrets (such as connection strings, passwords, and API keys) and blocks the push if a secret is detected. This provides centralized, enforced protection that prevents secrets from ever entering the repository, directly addressing the need.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Service connection
A service connection in Azure DevOps is a secure, configurable link that allows your pipelines to authenticate and interact with external services like Azure, GitHub, or on-premises servers.
Key term
Azure Repos
Azure Repos is a set of version control tools that allow teams to manage their source code, track changes, and collaborate on software projects using Git or Team Foundation Version Control (TFVC) within the Microsoft Azure ecosystem.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.