AZ-400 Question 84
Single answerYour team maintains a Git repository named 'FinanceApp' in Azure DevOps. You need to ensure that the QA group can view (read) every branch but cannot push any changes, while the Dev group should be able to read and push changes but must not be allowed to force push. Which configuration meets these requirements?
- A
Grant the QA group the 'Contribute' permission and set 'Force push (rewrite history)' to Deny for both QA and Dev groups.
- B
Set the QA group� 'Read' permission to Allow, 'Contribute' to Deny, and the Dev group� 'Force push (rewrite history)' to Deny.
- C
Allow the Dev group to bypass branch policies by granting 'Bypass policies when pushing' and set QA to read-only permissions.
- D
Add the QA group to the Contributors group and remove the Dev group from Contributors, while explicitly granting Dev 'Force push (rewrite history)'.
Show answer and explanation
Correct answer: B
Explanation
In Azure DevOps, repository permissions such as Read, Contribute, and Force push can be set for different groups to control who can view code, push changes, and perform advanced operations like rewriting commit history. Limiting the QA group to 'Read' (Allow) and 'Contribute' (Deny) matches the requirement that they only see the code but not modify it. Preventing force pushes for the Dev group ensures standard push operations can occur without the risk of rewriting commit history. For more details, see Microsoft� documentation on repository permissions and branching policies at https://learn.microsoft.com/azure/devops/repos/git/git-permissions.
- A. Incorrect.
Option 1 is incorrect because granting QA the 'Contribute' permission lets them push changes, which is against the requirement that QA must not push changes. Simply denying force push does not address QA� push restriction.
- B. Correct.
Option 2 is correct because setting QA to 'Read' (Allow) and 'Contribute' (Deny) ensures QA can view branches but not push changes. Denying 'Force push (rewrite history)' for the Dev group prevents them from rewriting history while allowing them standard push operations.
- C. Incorrect.
Option 3 is incorrect because 'Bypass policies when pushing' implies the Dev group can override branch policies. This goes beyond the stated requirement and does not specifically address the QA group's push restrictions.
- D. Incorrect.
Option 4 is incorrect because placing QA in the Contributors group still grants them the ability to push changes. Additionally, granting Dev the 'Force push (rewrite history)' permission directly contradicts the requirement not to allow force pushes.