AZ-400 Question 273
Select 2You are tasked with setting up automated scanning for container images and configuring CodeQL analysis in a container for a Python microservice hosted on GitHub. The goal is to detect both image vulnerabilities and code issues before deployment. Which two actions should you take to properly configure this pipeline?
- A
Use a GitHub Actions workflow that includes a dedicated container scanning tool (such as Trivy) in a separate step, then call the CodeQL container-based analysis action afterward.
- B
Run CodeQL analysis directly on the container image by injecting the analysis tool into the Dockerfile before building the final production image.
- C
Configure an Azure DevOps Release Pipeline to perform CodeQL analysis by installing the CodeQL extension on a hosted Linux agent without specifying a container job.
- D
Leverage a GitHub Actions workflow that uses a containerized job for CodeQL analysis and add a separate container scanning job or step using a security scanning tool, then publish the scanning reports.
Show answer and explanation
Correct answers: A, D
Explanation
In this scenario, you need to integrate both container image scanning and CodeQL analysis within a GitHub workflow. CodeQL focuses on scanning source code, while a dedicated security scanning tool (e.g., Trivy) or other third-party solutions scan container images for vulnerabilities. GitHub Actions supports running CodeQL in a containerized environment, and you can add multiple jobs (one for container scanning and another for CodeQL). For more details, see GitHub Docs on setting up CodeQL (https://docs.github.com/en/code-security/code-scanning/automating-code-scanning) and third-party container scanning tools.
- A. Correct.
Correct. Running container scanning via a specialized tool (e.g., Trivy) in a GitHub Actions workflow, followed by CodeQL analysis in a container, is a valid and recommended approach. It ensures vulnerabilities in both the container image and application code are detected early.
- B. Incorrect.
Incorrect. CodeQL is not designed to run directly on the container image. You typically run CodeQL against source code, not the built container, so injecting it into the Dockerfile is neither standard nor recommended.
- C. Incorrect.
Incorrect. While you can perform CodeQL analysis on Azure DevOps, the question scenario specifically mentions GitHub for hosting the code. Also, installing the CodeQL extension on a standard agent without referencing a container job does not fulfill the requirement for container-based scanning or container-based code analysis.
- D. Correct.
Correct. Using a container job for CodeQL analysis in a GitHub Actions workflow addresses the requirement to run CodeQL in a container. Adding a separate container scanning job ensures image vulnerabilities are also covered.