Enforcing GPG-Signed Commits Without Blocking SSH-Authenticated Developers
Your team uses GitHub for source control and GitHub Actions for CI/CD. Security policy requires that all code changes must be signed by a verified contributor using a GPG key. You need to enforce this requirement at the organization level. However, some developers use SSH keys for authentication, and you want to allow them to continue. What should you do?
Quick Answer
A branch protection rule on the default branch requiring signed commits is the standard way to enforce this without blocking SSH-authenticated developers — it checks that each commit carries a verified GPG signature regardless of how the developer authenticates to push. There's no organization-wide 'require SSH keys' setting, and a post-push GitHub Action only flags unsigned commits after they've already landed.
⚠ Common exam trap
The trap is that option A sounds plausible because it mentions both signed commits and SSH keys, but GitHub does not have a setting to 'require' SSH keys. The actual enforcement for signed commits is through the organization's 'Require signed commits' setting, which does not involve SSH key requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a branch protection rule for the default branch requiring signed commits.
Adding a branch protection rule for the default branch that requires signed commits enforces that all commits to that branch must be signed with a verified GPG key. While this does not apply to the entire organization, it is the standard method to enforce signing on the most critical branch. Option A is incorrect because GitHub does not have an organization setting to 'Require SSH keys for authentication'; the setting mentioned is not valid. Option B is incorrect because S/MIME signing via Microsoft Entra ID is not a native GitHub enforcement for commits. Option D is incorrect because a GitHub Action would only reject unsigned commits after they are pushed, not prevent them from being pushed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
In GitHub organization settings, enable 'Require signed commits' and 'Require SSH keys for authentication'.
Why it's wrong here
GitHub does not have an organization setting to 'Require SSH keys for authentication'. The only relevant setting is 'Require signed commits', but the mention of SSH keys makes this option factually invalid.
- ✗
Enforce S/MIME signing via Microsoft Entra ID Conditional Access.
Why it's wrong here
S/MIME signing via Microsoft Entra ID is not a GitHub-native enforcement for commits. GitHub uses GPG or S/MIME commits, but this must be configured within GitHub, not via Conditional Access.
- ✓
Add a branch protection rule for the default branch requiring signed commits.
Why this is correct
A branch protection rule on the default branch can require signed commits, enforcing that all commits pushed to that branch must be signed with a verified GPG key. This is a common and effective way to enforce the policy.
- ✗
Configure a GitHub Action that rejects unsigned commits in CI.
Why it's wrong here
A GitHub Action would only reject unsigned commits after they are pushed, not prevent the push. It is not an enforcement mechanism at the push level.
Go deeper
Related to this question
Learn chapter
Source Control Strategy Design
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
8 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses GitHub and wants to enforce that all commits to the main branch are signed with a GPG key that is verified against the user's GitHub account. Additionally, you want to block unsigned commits even if the committer is a repository admin. Which configuration should you use?
hard- A.Add a pre-receive hook that rejects unsigned commits.
- B.Enable 'Require signed commits' and set 'Include administrators' to false.
- ✓ C.Enable 'Require signed commits' and set 'Include administrators' to true.
- D.Enable 'Require signed commits' and configure web commit signing.
Why C: Enabling 'Require signed commits' in a GitHub branch protection rule, combined with setting 'Include administrators' to true, enforces that every commit pushed to the protected branch must be signed with a GPG key verified against the user's GitHub account, and this restriction applies even to repository administrators. This configuration blocks unsigned commits entirely, meeting the requirement to enforce signing for all users including admins.
Variation 2. Your team uses GitHub and wants to enforce a policy that all commits to the main branch must be signed with a GPG key that is associated with the author's GitHub account. Which method should you use to enforce this?
hard- A.Create a GitHub Actions workflow that runs a signature check after push
- B.Use a commit status check to verify signatures
- ✓ C.Add a branch protection rule that requires signed commits
- ✓ D.Configure a repository ruleset that requires signed commits
Why C: Both branch protection rules and repository rulesets support the 'Require signed commits' setting. Branch protection rules are the classic method, while repository rulesets are the newer feature. The question as written is ambiguous because it asks for a single method without excluding either. To make it a single-answer question, it should specify criteria such as 'classic' or 'simplest'. Otherwise, both C and D are correct.
Variation 3. Your company uses GitHub and wants to implement a compliance framework that requires signed commits for all repositories. Developers use various IDEs and Git clients. What is the best way to enforce signed commits across the organization?
hard- A.Set the repository to 'Require pull request reviews before merging' and rely on reviewers to check commit signatures.
- B.Ask developers to configure GPG keys and sign commits manually.
- ✓ C.Enable 'Require signed commits' in the branch protection rules for the default branch.
- D.Use a GitHub Action that fails if commits are unsigned.
Why C: GitHub allows repository administrators to enable 'Require signed commits' in branch protection rules. Option A is incorrect because it is not enforceable; commits can be unsigned. Option B is incorrect because it only encourages, not enforces. Option D is incorrect because it does not enforce signing.
Variation 4. Your team uses Azure Repos and wants to enforce that all commits to the release branch must be signed using GPG. Which branch policy should you enable?
hard- A.Limit merge types
- B.Check for linked work items
- C.Require a minimum number of reviewers
- ✓ D.Require signed commits
Why D: Azure Repos branch policies include a 'Require signed commits' setting that enforces GPG signature verification on all commits pushed to the branch. When enabled, any commit without a valid GPG signature is rejected, ensuring the integrity and authenticity of the commit author.
Variation 5. Your team uses GitHub repositories and wants to ensure that all code changes are signed by a verified contributor before merging. Which branch protection rule should you enable?
easy- ✓ A.Require signed commits
- B.Require pull request reviews before merging
- C.Require linear history
- D.Restrict who can push to matching branches
Why A: Requiring signed commits ensures that each commit is cryptographically verified using a GPG or S/MIME key linked to the contributor's GitHub account. This enforces non-repudiation and confirms the identity of the author, directly addressing the requirement that all code changes be signed by a verified contributor before merging.
Variation 6. Your team uses GitHub Enterprise to manage source code. You need to implement a security and compliance plan that ensures all commits are signed using GPG keys and that secrets are scanned before code is merged. Which GitHub features should you combine?
hard- ✓ A.Enable secret scanning alerts and require signed commits via branch protection rules.
- B.Enable Dependabot alerts and require pull request reviews before merging.
- C.Configure branch protection rules to require code owners review and enable automatic security fixes.
- D.Enable push protection for secret scanning and configure branch protection rules with 'Require signed commits' and 'Vigilant mode'.
Why A: The correct combination is A: Enable secret scanning alerts to detect secrets in code before merge, and use branch protection rules to require signed commits, ensuring all commits are GPG-signed. Push protection is more proactive but not required by the stated need to 'scan' secrets. 'Vigilant mode' is not a repository-level enforcement setting; the proper branch protection option is simply 'Require signed commits'.
Variation 7. Your team uses GitHub Enterprise with GitHub Actions. Compliance requires that all contributors sign commits with a verified GPG key. You have enabled 'Require signed commits' on the repository. However, a developer reports that their commits are being rejected even though they have configured a GPG key. The error says 'Commit must have a valid signature.' The developer's GPG key is listed in their GitHub account settings. What is the most likely cause?
easy- A.The developer's GPG key has expired.
- B.The developer's GPG key is not uploaded to GitHub.
- ✓ C.The developer's local Git email does not match the email associated with the GPG key in GitHub.
- D.GitHub only supports S/MIME, not GPG.
Why C: The most likely cause is that the developer's local Git email does not match the email associated with their GPG key in GitHub. When GitHub checks a signed commit, it verifies that the committer email matches one of the emails in the GPG key's UID. If they differ, the signature is considered unverified, even if the key is uploaded. Option A is incorrect because an expired key would produce a different error. Option B is incorrect because the developer already has the key uploaded. Option D is incorrect because GitHub supports GPG, not just S/MIME.
Variation 8. Your team uses GitHub and wants to enforce that all commits to the main branch are signed with a GPG key. Which branch protection rule should you configure?
easy- A.Require pull request reviews before merging.
- B.Require status checks to pass before merging.
- C.Require linear history.
- ✓ D.Require signed commits.
Why D: The 'Require signed commits' branch protection rule enforces that every commit pushed to the protected branch must be signed with a GPG key. This ensures cryptographic verification of the commit author's identity, directly addressing the requirement to enforce signed commits on the main branch.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.