AZ-400 Question 256
Select 2You are responsible for a microservices application whose container images are stored in Azure Container Registry. Your team wants to automatically detect vulnerabilities and compliance risks in these images during every build in an Azure DevOps CI pipeline. You must ensure that the pipeline blocks the deployment if any high-severity vulnerabilities are discovered. Which two steps should you implement to achieve this goal? (Choose two.)
- A
Integrate Microsoft Defender for Cloud� container scanning with Azure Container Registry to run image vulnerability scans automatically.
- B
Add a manual approval task in the build pipeline to review container vulnerability reports before merging changes to the main branch.
- C
Configure an Azure DevOps Security Gate (for example, with SCA tools like WhiteSource or open-source scanners) to fail the build on high-severity vulnerabilities.
- D
Use a Docker Build task with the --block-vulns parameter to prevent the container from being published to Azure Container Registry if vulnerabilities are detected.
- E
Enable Azure Resource Graph queries in your build pipeline to identify container security benchmarks and block release on errors.
Show answer and explanation
Correct answers: A, C
Explanation
To automate security and compliance scanning in Azure DevOps for container images, you typically integrate a security service or scanner that runs during the build process. Microsoft Defender for Cloud can automatically scan images in Azure Container Registry, and you can configure a Security Gate in the pipeline to block builds based on vulnerability severity. Refer to Microsoft documentation on 'Microsoft Defender for Cloud container image scanning' and 'Using security gates with Azure DevOps' for more details on properly implementing automated vulnerability assessment.
- A. Correct.
Option 1 is correct. Microsoft Defender for Cloud (formerly Azure Security Center) can be integrated with Azure Container Registry to automatically scan images for known vulnerabilities. When configured, it provides vulnerability assessment results and can block non-compliant images.
- B. Incorrect.
Option 2 is incorrect. While manual approval gates can help detect issues, it is not an automated security scanning method. It relies on human intervention rather than an automated process.
- C. Correct.
Option 3 is correct. Azure DevOps supports adding a Security Gate using third-party or native extensions (like WhiteSource or other open-source scanning tools). This gate can assess your container images or application code for vulnerabilities and fail the build if critical issues are discovered.
- D. Incorrect.
Option 4 is incorrect. Docker Build does not have a parameter like --block-vulns. Docker� native build process cannot directly block images due to security findings without integrating additional scanning tools or scripts.
- E. Incorrect.
Option 5 is incorrect. Azure Resource Graph queries are primarily for resource queries across Azure subscriptions and not for directly blocking container image builds in a CI pipeline.