Question 453 of 823
AZ-400 Develop a security and compliance plan Practice Question
Your team uses GitHub Enterprise with GitHub Actions. Compliance requires that all contributors sign commits with a verified GPG key. You have enabled 'Require signed commits' on the repository. However, a developer reports that their commits are being rejected even though they have configured a GPG key. The error says 'Commit must have a valid signature.' The developer's GPG key is listed in their GitHub account settings. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The developer's local Git email does not match the email associated with the GPG key in GitHub.
The most likely cause is that the developer's local Git email does not match the email associated with their GPG key in GitHub. When GitHub checks a signed commit, it verifies that the committer email matches one of the emails in the GPG key's UID. If they differ, the signature is considered unverified, even if the key is uploaded. Option A is incorrect because an expired key would produce a different error. Option B is incorrect because the developer already has the key uploaded. Option D is incorrect because GitHub supports GPG, not just S/MIME.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The developer's GPG key has expired.
Why it's wrong here
GPG key expiration is not implicated here because the error text indicates an invalid signature, not an expired key. GitHub would explicitly report that a key is expired or invalid for the commit, and an expired key would prevent the signature from being cryptographically validated, while the key's presence is not in dispute.
- ✗
The developer's GPG key is not uploaded to GitHub.
Why it's wrong here
The key is clearly uploaded to GitHub because it appears in the developer's account settings and GitHub recognizes the key during verification. The problem is that the key exists but cannot be matched to the commit's email address, so a missing-key scenario would produce a 'key not found' error rather than an unverified signature.
- ✓
The developer's local Git email does not match the email associated with the GPG key in GitHub.
Why this is correct
GitHub verifies a GPG signature by checking that the email associated with the public key matches the author and committer email addresses embedded in the Git commit. If the developer's local Git user.email differs from the email linked to the GPG key in GitHub, the signature is cryptographically valid but GitHub marks the commit as 'unverified' because the identity does not match.
- ✗
GitHub only supports S/MIME, not GPG.
Why it's wrong here
GitHub fully supports GPG for verifying commit and tag signatures; it does not support S/MIME for this purpose. The error is not about protocol support, because GPG is the primary mechanism, so the signature verification failure must be explained by a mismatch in identity details rather than the signing method.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 20, 2026
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.