AZ-400 Question 32
Single answerYou are responsible for container image security in an Azure DevOps environment. You have configured a pipeline task that scans container images for vulnerabilities before they are deployed to production. You want to track and alert on the daily number of critical vulnerabilities detected across all builds. Specifically, you need to raise an alert if the total count of newly discovered critical vulnerabilities exceeds a threshold in three consecutive daily runs. Which approach should you implement to meet these requirements?
- A
Use a custom PowerShell script to parse raw scan logs stored in Azure Repos, then manually review daily results in the pipeline summary.
- B
Integrate vulnerability scan results with Azure Monitor logs via Log Analytics, create a custom metric for critical vulnerabilities using Kusto queries, and configure an alert rule that triggers if the daily count crosses the set threshold three days in a row.
- C
Implement an Azure Policy definition for container scanning and rely on Azure Policy compliance reports for daily vulnerability notifications.
- D
Set up a gated check in Azure Repos that halts merges when a single critical vulnerability is detected in any commit.
Show answer and explanation
Correct answer: B
Explanation
Using Azure Monitor and Log Analytics is a recommended approach for implementing security metrics and queries at scale. By ingesting vulnerability data from container scans and creating a custom metric (e.g., 'CriticalVulnerabilityCount'), you can use Kusto Query Language (KQL) to query and aggregate results over time. Then, configuring an alert rule to fire when the metric exceeds a threshold for multiple consecutive days ensures proactive notification. For more information, refer to Azure Monitor documentation (https://docs.microsoft.com/azure/azure-monitor/) and best practices on integrating security scanning data with Log Analytics.
- A. Incorrect.
Incorrect. While a PowerShell script can help parse logs, it does not provide an automated way to store historical data or generate alerts based on consecutive daily thresholds. It also requires manual effort to review results each day.
- B. Correct.
Correct. Integrating scan results into Azure Monitor logs via Log Analytics allows you to write Kusto queries to track critical vulnerabilities. By creating a custom metric and configuring an alert rule on that metric, you can automatically detect and notify when the daily count exceeds a defined threshold for multiple consecutive days.
- C. Incorrect.
Incorrect. Azure Policy can enforce certain rules and provide compliance data, but it is not designed to aggregate daily vulnerability scan counts or create alert conditions spanning multiple days in the manner described.
- D. Incorrect.
Incorrect. A gated check prevents code merges based on set conditions, but it does not offer tracking or alerting on consecutive daily vulnerability counts. It focuses on immediate pass/fail criteria for each commit or pull request.