A deployment job targets an environment named production, and the team needs GitHub itself to gate the deployment so a run pauses for human approval and is also held for a fixed delay before it can begin, with both controls enforced outside the workflow steps. Which two controls are configured as protection rules on the production environment to meet this intent? Select TWO.
- AAdd a required reviewers rule to the environment so a named person or team must approve each deployment before the job proceeds. Correct
- BAdd a wait timer rule to the environment so every run is held for a fixed delay before the deployment job is allowed to start. Correct
- CAdd a concurrency block at the job level in the workflow file so only one deployment runs against the environment at a time.
- DAdd a branch protection ruleset to the main branch so pushes are reviewed before the deployment job reads the environment secret.
Why A is correct: Required reviewers is a genuine environment protection rule that pauses the run until an approver acts, enforced by GitHub rather than a step.
Why B is correct: A wait timer is an environment protection rule that holds the deployment for a configured delay, providing the fixed cooling-off period before it begins.
Why C is wrong: Concurrency limits overlapping runs but lives in the workflow YAML, so it is not an environment protection rule and provides neither approval nor a fixed delay.
Why D is wrong: Branch protection reviews code changes on a branch, not deployments to an environment, so it cannot pause a run for approval or impose a deployment delay.