AZ-400 Question 272
Select 2You manage a GitHub repository that hosts a Dockerized .NET Core application. The organization requires that container images be automatically scanned for vulnerabilities in your CI process, and that CodeQL analysis is performed within a container to ensure consistent runtime environments. Which two actions should you configure in your GitHub Actions workflow to achieve these requirements?
- A
Add the GitHub CodeQL Action to your workflow and specify 'container: ' at the job level.
- B
Use a container scanning GitHub Action (for example, microsoft/security-devops-action) to run vulnerability scans on your Docker image.
- C
Disable ephemeral GitHub runners so that containerized scans can persist across multiple runs.
- D
Depend solely on local developer machines to run CodeQL analyses before pushing code to the repository.
Show answer and explanation
Correct answers: A, B
Explanation
To automate container image vulnerability scanning, use a dedicated scanning Action (such as microsoft/security-devops-action) within your GitHub Actions workflow. For CodeQL analysis, you can run the official CodeQL Action inside a container by specifying 'container:' at the job level, ensuring the same tools and dependencies are used each time. This approach is recommended in GitHub documentation (https://docs.github.com/en/code-security/codeql).
- A. Correct.
Correct. Setting 'container: ' at the job level in your GitHub Actions workflow allows the CodeQL analysis job to run inside a specified container, ensuring a consistent environment for scanning. This is the recommended approach if you need a controlled, repeatable environment for CodeQL.
- B. Correct.
Correct. Using a container scanning Action (like microsoft/security-devops-action or another vulnerability scanning Action) automates security checks on your Docker image. It integrates seamlessly into GitHub Actions and streamlines the process of detecting vulnerabilities before images are deployed.
- C. Incorrect.
Incorrect. Disabling ephemeral GitHub runners does not improve container scanning or CodeQL analysis and is generally discouraged. Ephemeral runners ensure a clean, secure environment for every workflow run, which is vital for reliable security scans.
- D. Incorrect.
Incorrect. Relying solely on local development machines for CodeQL analysis is error-prone and inconsistent, as it places the burden on every developer� environment. Integrating both container scanning and CodeQL into the CI workflow ensures uniform policies and consistent coverage.