Microsoft DevOps Engineer Expert AZ-400 Practice Question

Azure DevOps environments support "approvals and checks" that run before a deployment job in a stage can start. The built-in Azure Policy compliance check (AzurePolicyCheck) evaluates the target subscription or resource group against assigned policies and blocks the deployment until the scan passes. Adding this check to the prod environment enforces the gate independently of the pipeline YAML. Executing a script inside the job runs after resources are already created and cannot halt the stage in advance. Branch protection rules apply to repository merges, not runtime deployment governance. A ManualValidation task pauses the job for human approval, not automated policy evaluation.