AZ-400 Practice Question: Design and implement build and release pipelines
Which TWO practices help improve the security of container images in a CI/CD pipeline? (Choose two.)
⚠ Common exam trap
Candidates often confuse the 'latest' tag with a security best practice, but it undermines reproducibility and security by introducing uncontrolled updates. Also, some may think running with root privileges avoids permission issues, but it increases attack surface. Signing and scanning are the verifiable security controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign container images to verify their integrity.
Signing container images (Option C) ensures their integrity and authenticity by allowing the CI/CD pipeline to verify that the image has not been tampered with since it was signed, typically using tools like Docker Content Trust (DCT) or Notary. Scanning container images for vulnerabilities (Option E) during the build identifies known security issues in the image layers and dependencies, allowing teams to remediate before deployment. Both practices are essential for supply chain security. The other options are incorrect: running as root increases risk, public registries expose images, and 'latest' tags cause unpredictable updates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run containers with root privileges to avoid permission issues.
Why it's wrong here
Running containers as root grants unnecessary privileges, expanding the attack surface and potentially allowing an attacker who compromises the container to access the host and other containers. Follow the principle of least privilege by using non-root users, read-only filesystems, and dropping capabilities.
- ✗
Store container images in a public registry for easy access.
Why it's wrong here
Public registries expose images to the world, increasing the risk of unauthorized access, tampering, or accidental exposure of sensitive data. Use private registries with access controls, authentication, and image scanning to maintain security and control over image distribution.
- ✓
Sign container images to verify their integrity.
Why this is correct
Signing container images cryptographically verifies the publisher's identity and guarantees the image has not been tampered with, ensuring that only trusted images are deployed. This helps prevent supply-chain attacks.
- ✗
Use the 'latest' tag for base images to always get the newest patches.
Why it's wrong here
'latest' tags are mutable and can introduce breaking changes; pinning to specific tags is recommended.
- ✓
Scan container images for vulnerabilities during the build.
Why this is correct
Scanning images for vulnerabilities during the build pipeline identifies known security issues in base images, dependencies, and application code before deployment, allowing remediation early and reducing the risk of introducing vulnerable containers into production.
Go deeper
Related to this question
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.