Microsoft DevOps Engineer Expert AZ-400 Practice Question

To stop direct pushes to a branch, the Contribute permission for that branch must be denied. Denying Contribute prevents users from pushing commits or merging directly. Developers still need Read to fetch the branch and Contribute to pull requests to submit pull-requests that target the branch. Setting Contribute to pull requests to Allow (or leaving it Inherited when it is Allow) lets them create PRs even though Contribute is denied. Denying Create branch would block them from creating feature branches, and denying Read would block all access. Simply relying on branch policies without changing permissions would still allow a user who has Contribute to bypass the policy by pushing directly from the command line. Therefore, the correct configuration is: Read = Allow (or Inherited), Contribute = Deny, Contribute to pull requests = Allow.