AZ-400 Practice Question: Design and implement a source control strategy
Your team uses Azure Repos and wants to enforce that all commits to the release branch must be signed using GPG. Which branch policy should you enable?
⚠ Common exam trap
Test-takers frequently confuse 'Require signed commits' with other authentication or authorization policies, such as requiring reviewers or limiting merge types, because all are listed under branch policy settings but serve entirely different security purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require signed commits
Azure Repos branch policies include a 'Require signed commits' setting that enforces GPG signature verification on all commits pushed to the branch. When enabled, any commit without a valid GPG signature is rejected, ensuring the integrity and authenticity of the commit author.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Limit merge types
Why it's wrong here
Limiting merge types restricts which merge strategies (e.g., merge commit, squash, or rebase) can be used on a pull request, but it does not provide any cryptographic authentication of the commit author or committer. This policy therefore cannot enforce that commits are signed.
- ✗
Check for linked work items
Why it's wrong here
Checking for linked work items ensures that a pull request is associated with an Azure Boards item for traceability, but it does not verify the identity of who made the commit or validate its integrity. As a result, it cannot enforce that commits are signed.
- ✗
Require a minimum number of reviewers
Why it's wrong here
Requiring a minimum number of reviewers mandates a certain count of approvals before a pull request can complete, which only controls the human review process. This policy does not inspect the commit data itself, so it cannot enforce or verify signed commits.
- ✓
Require signed commits
Why this is correct
Requiring signed commits is the policy that enforces each commit to be cryptographically signed with GPG or S/MIME, thereby verifying the identity of the committer and ensuring the commit content has not been tampered with. This directly fulfills the goal of enforcing that all commits are signed.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Repos
Azure Repos is a set of version control tools that allow teams to manage their source code, track changes, and collaborate on software projects using Git or Team Foundation Version Control (TFVC) within the Microsoft Azure ecosystem.
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.