AZ-400 Question 73
Select 2Your company is implementing a new project in Azure DevOps. They want all changes to the 'main' branch to be merged through pull requests requiring at least one peer reviewer. However, the DevOps team needs the build pipeline to continue pushing semantic version tags to the repository. Which two configuration changes should you implement in Azure DevOps to meet these requirements? (Choose two).
- A
Set up a branch policy on 'main' that requires at least one reviewer before completing a pull request
- B
Grant the build pipeline the 'Contribute to tags' permission while restricting direct pushes to 'main' by other users
- C
Disable forced pushes on 'main' by setting 'Contribute' to 'Deny' for all users, including the build pipeline account
- D
Enable mandatory branch policies for a separate 'build' branch that requires at least two reviewers
Show answer and explanation
Correct answers: A, B
Explanation
To meet both the pull request requirement and automated tagging needs, you must configure a branch policy on 'main' to enforce at least one reviewer and separately grant necessary tag permissions to your build pipeline. According to Azure DevOps best practices, branch policies help maintain code quality and review processes, while fine-grained permissions on tags allow CI/CD pipelines to manage versioning without bypassing the review policy. For more details, refer to Microsoft� official Azure Repos documentation on branch policies (https://docs.microsoft.com/azure/devops/repos/git/branch-policies).
- A. Correct.
Correct: Configuring a branch policy on the 'main' branch to require at least one reviewer enforces that all changes go through a pull request with peer review. This meets the requirement for code quality and teamwork.
- B. Correct.
Correct: Allowing only the build pipeline to push tags while restricting direct pushes to 'main' for other users ensures that automated version tagging can still occur without bypassing the pull request process. This aligns with a best-practice DevOps workflow where human-driven merges are always reviewed, but automated processes can still commit tags.
- C. Incorrect.
Incorrect: Denying the 'Contribute' permission to all users, including the build pipeline account, would block the pipeline from pushing tags as well. This would prevent the build pipeline from automating version numbering and tagging.
- D. Incorrect.
Incorrect: The requirement explicitly applies to the 'main' branch, not a separate 'build' branch. Setting mandatory policies on a different branch would not enforce the necessary reviews on 'main' and would fail to address the scenario's objectives.