AZ-400 Question 258
Single answerYour organization produces containerized applications for a specialized finance platform, which are stored in an Azure Container Registry (ACR) and deployed to Azure Kubernetes Service (AKS). The security team wants to ensure that vulnerabilities are discovered as early as possible in the pipeline, ideally before any images are pushed to ACR. Which approach should you implement to automate container scanning in Azure DevOps?
- A
Enable Microsoft Defender for Cloud at the subscription level to automatically block any vulnerable image from being deployed to AKS.
- B
Configure ACR tasks to run routine image scans after the images have been pushed to the ACR.
- C
Add a container scanning extension in the Azure DevOps build pipeline to run a vulnerability scan before pushing images to the ACR.
- D
Attach a script in the release pipeline that queries the vulnerability data stored in the ACR logs before deployment to AKS.
Show answer and explanation
Correct answer: C
Explanation
Automating container scanning in Azure DevOps typically involves integrating a reputable scanning tool or extension into your build pipeline. This approach ensures that any discovered vulnerabilities are addressed before sensitive artifacts are pushed to the registry or deployed. Microsoft Defender for Cloud provides ongoing scanning for images in ACR, but it does not replace the immediate feedback needed in the build stage. Microsoft Documentation on integrating container scanning tools in Azure DevOps pipelines can be found at: https://docs.microsoft.com/azure/devops/pipelines/secure (which describes security best practices and references various scanning extensions).
- A. Incorrect.
Option 1: While enabling Microsoft Defender for Cloud helps detect vulnerabilities in container images stored in ACR, it does not automatically block images at the subscription level before they're pushed to the registry or integrated into the pipeline. Defender for Cloud can alert you of vulnerabilities, but it doesn't prevent them at the build stage; thus, this doesn't meet the requirement of detecting issues early in the pipeline.
- B. Incorrect.
Option 2: Configuring Azure Container Registry tasks to scan images after pushing can identify vulnerabilities, but those scans occur later in the process. The question specifically states a need to discover vulnerabilities before pushing images to ACR, making this approach less effective for early detection.
- C. Correct.
Option 3 (Correct): Adding a container scanning extension (such as Snyk, Aqua, Trivy, or similar) to the build pipeline ensures images are scanned immediately after they're built and before they're pushed to ACR. This method aligns perfectly with the requirement to detect vulnerabilities as early as possible, preventing compromised images from ever reaching the registry.
- D. Incorrect.
Option 4: A script in the release pipeline that checks ACR logs only identifies issues after images are already stored in ACR and ready for release. This meets post-deployment detection but does not fulfill the requirement of discovering vulnerabilities at the earliest possible stage.