AZ-400 Develop a security and compliance plan Practice Question
Your team uses GitHub Actions and needs to enforce that all workflows must use approved actions from a curated list. What is the best way to implement this?
⚠ Common exam trap
Test-takers frequently confuse branch protection rules (which control code changes) with action governance policies (which control which actions can run), leading candidates to incorrectly select branch protection as the enforcement mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up an allowed list of actions in organization settings
GitHub Organizations allow administrators to define an 'allowed list' of actions under Settings > Actions > Policies, restricting workflow execution to only approved actions from the curated list. This directly enforces the requirement that all workflows use only approved actions, preventing the use of unverified or malicious third-party actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure branch protection rules
Why it's wrong here
Branch protection rules control who can push, merge, or require pull request reviews, but they do not govern which GitHub Actions can execute. To enforce an allowlist of actions, you must configure the allowed actions list in the organization's Actions settings, not branch protection.
- ✓
Set up an allowed list of actions in organization settings
Why this is correct
In GitHub organization settings, under Actions > General, you can choose 'Allow only selected actions' and specify an allowlist of actions and reusable workflows. This restricts all workflows in the organization to only use approved actions, directly enforcing the required policy.
- ✗
Enable Dependabot alerts
Why it's wrong here
Dependabot alerts automatically identify known security vulnerabilities in project dependencies and notify you, but they do not restrict which actions or reusable workflows can be used in pipelines. Therefore, enabling Dependabot alerts would not enforce an allowlist of actions.
- ✗
Use OpenID Connect (OIDC)
Why it's wrong here
OpenID Connect (OIDC) is used to authenticate workflows to cloud providers or external services without storing long-lived secrets, but it does not control which actions are permitted to run in workflows. As such, OIDC has no effect on enforcing an action allowlist.
Go deeper
Related to this question
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.