AZ-400 Question 257
Single answerYou are a DevOps engineer at a company developing containerized microservices for deployment to Azure Kubernetes Service (AKS). The container images are stored in Azure Container Registry (ACR), and you must enforce security scanning on every build so that if any high-severity vulnerabilities are discovered, the build pipeline automatically fails. Which approach should you recommend to meet these requirements?
- A
A. Configure an automated security scanning task (e.g., from a third-party extension like Snyk or WhiteSource) in your Azure DevOps CI pipeline to scan container images and fail the build on high-severity vulnerabilities.
- B
B. Enable only Azure Policy on the resource group hosting your ACR, assuming it will block the pipeline if vulnerabilities are found.
- C
C. Manually run vulnerability scans on container images from your local environment before pushing them to the registry.
- D
D. Rely on the default Azure Container Registry logging to detect and quarantine any container images with vulnerabilities.
Show answer and explanation
Correct answer: A
Explanation
By incorporating a dedicated scanning step in your CI pipeline with a security extension (such as Snyk or WhiteSource), you ensure that the container images are automatically evaluated against known vulnerabilities. If high-severity issues are found, the build can be set to fail, thus preventing insecure images from moving further down the deployment pipeline. Refer to Microsoft� documentation on GitHub and Azure DevOps Marketplace extensions for detailed guidance on integrating third-party or built-in scanning solutions.
- A. Correct.
A. Correct. Configuring an automated scanning task within your pipeline and blocking builds based on severity is a best practice. By using a scanning extension (e.g., Snyk, WhiteSource) or built-in DevOps tasks that integrate security scanning, you ensure immediate feedback and can fail the build on critical vulnerabilities.
- B. Incorrect.
B. Incorrect. Azure Policy can enforce certain compliance rules, but it does not inherently fail the CI pipeline on discovering vulnerabilities. It can block resource creation based on policy, but does not directly integrate with pipeline build decisions about container vulnerabilities.
- C. Incorrect.
C. Incorrect. Manual scans rely on user diligence and do not automatically fail the build. This approach is error-prone, lacks automation, and doesn�t provide consistent enforcement within the DevOps workflow.
- D. Incorrect.
D. Incorrect. ACR logs can help in auditing image pushes or pulls, but do not include an automated mechanism to fail builds due to detected vulnerabilities. Additional services or integrations must be used for active scanning and blocking.