Exam AZ-400 topic 4 question 78 discussion

B. Add a status check to the policies of the main branch. Explanation: To ensure that all code for App1 passes a security validation before deployment, you want to enforce that code cannot be merged into the main branch unless it passes your custom security validation tool. By adding a status check to the main branch policies, you can require that a specific check (such as the result of your custom tool) must succeed before pull requests can be completed and code can be merged. This is the standard and recommended way to enforce pre-deployment validations in Azure Pipelines.

you need to catch vulnerabilities "before" deployment because once it's in PROD with vulnerabilities, you would need to do a rollback. So, performing the tests in TEST environment is more appropriate and cause less headaches of having to rollback.

B is correct, deployment

A is correct answer. Do not listen MrAZ105

B is correct

Status check on a PR of the feature branch. Once approved, merge to main. Performing a check on the main branch means that it's already been approved and failed the status check after approval.

I would say option A Option B could work but is less ideal because it's applied to the main branch, and security validation should generally be enforced earlier in the development process (e.g., on the feature/development branches) to catch issues before they reach the main branch.