AZ-400 Develop a security and compliance plan Practice Question
Your team uses GitHub Enterprise with GitHub Actions. Compliance requires that all contributors sign commits with a verified GPG key. You have enabled 'Require signed commits' on the repository. However, a developer reports that their commits are being rejected even though they have configured a GPG key. The error says 'Commit must have a valid signature.' The developer's GPG key is listed in their GitHub account settings. What is the most likely cause?
⚠ Common exam trap
The trap is assuming that uploading the GPG key is sufficient — AZ-400 tests the subtle email-binding requirement, so candidates overlook that the commit email must match the key's email in GitHub.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The developer's local Git email does not match the email associated with the GPG key in GitHub.
GitHub verifies a GPG signature by matching the signing key's associated email (and key ID) against the commit's author/committer email. If the developer's local Git user.email does not match the email registered with the GPG key in GitHub, GitHub marks the signature as unverified and the 'Require signed commits' rule rejects the push with 'Commit must have a valid signature.' The key being present in GitHub settings is not sufficient — the email binding must also match.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The developer's GPG key has expired.
Why it's wrong here
GPG key expiration is not implicated here because the error text indicates an invalid signature, not an expired key. GitHub would explicitly report that a key is expired or invalid for the commit, and an expired key would prevent the signature from being cryptographically validated, while the key's presence is not in dispute.
- ✗
The developer's GPG key is not uploaded to GitHub.
Why it's wrong here
The key is clearly uploaded to GitHub because it appears in the developer's account settings and GitHub recognizes the key during verification. The problem is that the key exists but cannot be matched to the commit's email address, so a missing-key scenario would produce a 'key not found' error rather than an unverified signature.
- ✓
The developer's local Git email does not match the email associated with the GPG key in GitHub.
Why this is correct
GitHub verifies a GPG signature by checking that the email associated with the public key matches the author and committer email addresses embedded in the Git commit. If the developer's local Git user.email differs from the email linked to the GPG key in GitHub, the signature is cryptographically valid but GitHub marks the commit as 'unverified' because the identity does not match.
- ✗
GitHub only supports S/MIME, not GPG.
Why it's wrong here
GitHub fully supports GPG for verifying commit and tag signatures; it does not support S/MIME for this purpose. The error is not about protocol support, because GPG is the primary mechanism, so the signature verification failure must be explained by a mismatch in identity details rather than the signing method.
Go deeper
Related to this question
Learn chapter
Designing a Security and Compliance Plan
Key term
Git
Git is a version control system that tracks changes to files so multiple people can work on the same project without overwriting each other's work.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
One of 696 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.