AZ-400 Question 271
Select 2You have a microservices application stored in a GitHub repository. You need to build container images using GitHub Actions and then automatically scan those images for vulnerabilities. Additionally, you must run CodeQL analysis in a container environment to detect potential vulnerabilities in your codebase. Which two actions should you take in your GitHub Actions workflow to meet these requirements?
- A
Add a step that uses a container scanning action (such as Aqua Security� Trivy or a similar marketplace action) to scan the newly built Docker image for vulnerabilities.
- B
Configure the CodeQL analysis job with a 'container' property pointing to an image that has the CodeQL CLI or CodeQL dependencies installed, and run both 'init' and 'analyze' steps in that container.
- C
Set the RUNNER_OS environment variable to Linux in the GitHub Actions workflow so that vulnerability scanning will run automatically without any additional steps.
- D
Install the CodeQL CLI in the same step you use to build the Docker image, ensuring all scanning commands are invoked within the Docker build process.
Show answer and explanation
Correct answers: A, B
Explanation
In GitHub Actions, container image scanning typically requires using a specific action or tool (e.g., Trivy or Aqua Security� scanner) to detect vulnerabilities in the built images. CodeQL analysis can be configured to run in a container by specifying a container image that has CodeQL dependencies pre-installed and running the 'init' and 'analyze' steps within that container. Refer to GitHub's documentation on container scanning (https://docs.github.com/en/actions/security-guides/security-hardening-guides/configuring-secure-github-actions#scan-your-container-images) and CodeQL (https://docs.github.com/en/code-security/code-scanning/automating-code-scanning/configuring-codeql-cli) for best practices and configuration details.
- A. Correct.
Correct. Using a recognized container scanning action or extension (e.g., Trivy) is a common and effective way to scan your newly built Docker image for security vulnerabilities. This step typically runs after the image build and before deploying or pushing the image to a registry.
- B. Correct.
Correct. To run CodeQL analysis in a container, you must specify a 'container' property in your GitHub Actions job configuration to pull an image with the necessary CodeQL tooling. You then run 'codeql init' (or 'init' under the official GitHub Actions syntax) and 'codeql analyze' (or 'analyze') within that container to scan the codebase.
- C. Incorrect.
Incorrect. While setting RUNNER_OS to Linux ensures the workflow runs on a Linux-based runner, it does not automatically enable container scanning. A separate scanning step or action is still required to detect vulnerabilities in the container image.
- D. Incorrect.
Incorrect. Simply installing the CodeQL CLI during the Docker build phase won�t automate scanning outside the build process. CodeQL analysis typically runs on the host or in a separate container job after the code has been checked out, ensuring CodeQL can analyze the entire codebase rather than just the Docker build context.