AZ-400 Practice Question: Design and implement build and release pipelines
Your Azure Pipeline builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure that the image is scanned for vulnerabilities before being pushed. Which task should you add to the pipeline?
⚠ Common exam trap
Watch out — candidates often confuse the Azure CLI task with a hypothetical 'az acr scan' command, or assume the Docker push action inherently includes security scanning, when in fact Microsoft Defender for Cloud provides a dedicated task for that purpose.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Container scanning task from Microsoft Defender for Cloud
Microsoft Defender for Cloud provides a dedicated container scanning task that integrates directly into Azure Pipelines to scan Docker images for vulnerabilities before they are pushed to ACR. This task leverages the same vulnerability assessment engine used by Microsoft Defender for Cloud to identify CVEs in OS packages and application dependencies, ensuring only compliant images are pushed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure CLI task to run 'az acr scan'
Why it's wrong here
The 'az acr scan' command does not exist within the Azure CLI. The Azure CLI includes commands like 'az acr build', 'az acr import', and 'az acr repository', but image vulnerability scanning is not a native ACR operation. Vulnerability assessment is handled by Microsoft Defender for Cloud, which requires either the dedicated Container scanning task in Azure Pipelines or direct calls to the Defender for Cloud API. Therefore, using an Azure CLI task with this non-existent command would fail and would not perform any security scan.
- ✗
Docker task with the 'push' action
Why it's wrong here
The Docker task with the 'push' action only builds and pushes the Docker image to a registry such as ACR; it does not perform any vulnerability scanning or security assessment. The push action simply uploads the image layers, so any security analysis must be done separately via a dedicated scanning task or service.
- ✓
Container scanning task from Microsoft Defender for Cloud
Why this is correct
The Container scanning task from Microsoft Defender for Cloud is a dedicated Azure DevOps task that integrates with Microsoft Defender for Cloud to scan container images for vulnerabilities, including OS packages and language-specific dependencies. It can be configured to run after a successful push to Azure Container Registry, providing actionable security findings and can fail the pipeline if critical vulnerabilities are detected.
- ✗
PublishBuildArtifacts task
Why it's wrong here
The PublishBuildArtifacts task publishes build artifacts to Azure Pipelines or a file share for later stages or releases; it has no capability to inspect Docker images for vulnerabilities. This task is unrelated to container security scanning and would not satisfy the requirement to scan the image for vulnerabilities.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
Key term
Container scanning
Container scanning is the automated process of inspecting container images for known security vulnerabilities, misconfigurations, and compliance issues before they are deployed.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.