hardMultiple ChoiceObjective-mapped
Using ACR Tasks to Automatically Scan Images After Every Push
An organization uses an on-premises Jenkins server to build Docker images and push them to Azure Container Registry (ACR). The security team requires that all images be scanned for vulnerabilities before deployment. The DevOps team needs to automate this scanning after each push. What is the most efficient way to meet this requirement?
Quick Answer
An ACR task triggered by image push events is the efficient, event-driven way to scan every image automatically the moment it lands in the registry — no extra infrastructure, no manual trigger, and no gap between push and scan. ACR Tasks integrate natively with vulnerability scanners like Microsoft Defender for Cloud or third-party tools such as Trivy for exactly this pattern.
⚠ Common exam trap
Many candidates confuse Azure Policy with an action that performs scanning, or assume ACR webhooks can directly trigger Jenkins jobs for scanning, when in fact ACR Tasks provide a simpler, event-driven, and fully managed solution for post-push scanning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an ACR task that runs a vulnerability scanner triggered by image push events.
ACR Tasks natively support automated vulnerability scanning via integration with Azure Security Center or third-party scanners like Trivy. By creating an ACR task that triggers on image push events, the organization can scan images immediately after they are pushed without additional infrastructure or manual intervention. This approach is event-driven, serverless, and aligns with the requirement to automate scanning after each push.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Policy to enforce vulnerability scanning.
Why it's wrong here
Azure Policy can audit but not automatically scan on push.
- ✗
Configure a Jenkins job to scan images before pushing to ACR.
Why it's wrong here
This would add latency to the build pipeline and not cover images from other sources.
- ✗
Configure a webhook in ACR to notify Jenkins to scan the image.
Why it's wrong here
Webhook adds complexity and Jenkins might not be always available.
- ✓
Create an ACR task that runs a vulnerability scanner triggered by image push events.
Why this is correct
ACR tasks can be triggered by push events and run custom steps like scanning.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team uses Azure Pipelines to deploy to Azure Kubernetes Service (AKS). The security team requires that all container images be scanned for vulnerabilities before deployment. You have configured a container registry with Microsoft Defender for Cloud integration. What should you add to your pipeline to ensure only compliant images are deployed?
medium- A.Set up Azure Policy to deny deployments of images without scan results.
- B.Add a task that runs a vulnerability scan on the image after deployment.
- C.Configure the AKS cluster to scan images after pulling.
- ✓ D.Use the 'Azure Container Registry' task with the 'Scan' option to check vulnerabilities and fail the pipeline if critical vulnerabilities exist.
Why D: To ensure only compliant images are deployed, you must add a vulnerability scan step before deployment that fails the pipeline on critical findings. Microsoft Defender for Cloud scans images in ACR on push, and results can be queried via the Azure CLI or REST API. There is no built-in Azure Pipelines task named 'Azure Container Registry' with a 'Scan' action. A common pattern is to use an Azure CLI task to query scan results or integrate a third-party scanner like Trivy, then conditionally fail the pipeline. None of the listed options accurately describes this.
Variation 2. Your organization is adopting DevSecOps and wants to integrate security scanning into the CI/CD pipeline. Which tool should you use to scan container images for vulnerabilities?
easy- A.Azure Monitor
- B.GitHub Copilot
- ✓ C.Microsoft Defender for Cloud
- D.Azure Logic Apps
Why C: Microsoft Defender for Cloud (Option C) is the correct tool for scanning container images for vulnerabilities in a CI/CD pipeline, as it integrates with Azure Container Registry to perform vulnerability assessments. Option A (Azure Monitor) is incorrect because it is a monitoring and observability service, not a security scanner. Option B (GitHub Copilot) is incorrect as it is an AI code completion tool. Option D (Azure Logic Apps) is incorrect because it is a workflow automation service, not a security scanning tool.
Variation 3. Your organization needs to ensure that all containers built in Azure Pipelines are scanned for vulnerabilities before being pushed to a container registry. Which step should you add to the pipeline?
easy- ✓ A.Add a step to use 'Microsoft Defender for Cloud' container image scanning.
- B.Add a step to create an Azure Container Registry task for scanning.
- C.Add a step to push the image to Docker Hub for scanning.
- ✓ D.Add a step to run Trivy to scan the image.
Why A: Both Microsoft Defender for Cloud and Trivy can be used as pipeline steps to scan container images for vulnerabilities before pushing to a registry. Since the stem does not restrict to a Microsoft-native solution, both A and D are correct.
Variation 4. Your Azure Pipeline builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure that the image is scanned for vulnerabilities before being pushed. Which task should you add to the pipeline?
hard- A.Azure CLI task to run 'az acr scan'
- B.Docker task with the 'push' action
- ✓ C.Container scanning task from Microsoft Defender for Cloud
- D.PublishBuildArtifacts task
Why C: Microsoft Defender for Cloud provides a dedicated container scanning task that integrates directly into Azure Pipelines to scan Docker images for vulnerabilities before they are pushed to ACR. This task leverages the same vulnerability assessment engine used by Microsoft Defender for Cloud to identify CVEs in OS packages and application dependencies, ensuring only compliant images are pushed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.