Develop a security and compliance plan →hardMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

{
  "query": "ContainerRegistryLoginEvents\n| where TimeGenerated > ago(7d)\n| where ResultType != 'Success'\n| summarize FailureCount = count() by Repository, Action",
  "result": [
    {"Repository": "contoso/webapp", "Action": "push", "FailureCount": 15},
    {"Repository": "contoso/api", "Action": "pull", "FailureCount": 3}
  ]
}

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to audit Azure Container Registry login failures. The result shows 15 failed push attempts to the 'contoso/webapp' repository and 3 failed pull attempts to 'contoso/api'. What is the most likely security implication?

⚠ Common exam trap

The trap here is that candidates may misinterpret failed pull attempts as evidence of a successful breach (Option C), but the query explicitly shows failures, not successes, and the real threat is the repeated push failures indicating an active attack.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

An attacker is attempting to push malicious images to the 'contoso/webapp' repository.

The query shows 15 failed push attempts to 'contoso/webapp' and 3 failed pull attempts to 'contoso/api'. Repeated failed push attempts to a specific repository are a classic indicator of an attacker trying to upload malicious images, as push operations require authentication and authorization. The high number of failures suggests a brute-force or credential-stuffing attack targeting the push operation, which is the most direct path to compromising the registry with unauthorized content.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The audit logs are not enabled for the container registry.
Why it's wrong here
The query is actively returning results from the AuditLogs table, which proves that diagnostic and audit settings are enabled for the container registry; if audit logs were disabled, the KQL query would return no audit events, not a pattern of failed operations.
✗
The container registry is misconfigured and allowing anonymous pushes.
Why it's wrong here
The log entries reflect repeated authentication failures during push attempts, which demonstrates that the registry requires valid credentials and is not configured to allow anonymous pushes; anonymous access would result in successful operations without authentication errors.
✗
The 'contoso/api' repository has been successfully pulled by an unauthorized user.
Why it's wrong here
The query shows failed pull operations against the 'contoso/api' repository, meaning that any unauthorized user's attempts to pull were rejected due to insufficient permissions; a successful unauthorized pull would be logged as an allowed operation, not as a failure.
✓
An attacker is attempting to push malicious images to the 'contoso/webapp' repository.
Why this is correct
Multiple consecutive failed push events targeting the 'contoso/webapp' repository strongly indicate an attacker is attempting to upload malicious images using compromised or guessed credentials; although the pushes are failing, the systematic pattern of unauthorized write attempts is a clear security threat.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question