AZ-400 Develop a security and compliance plan Practice Question
Your organization is adopting DevSecOps and wants to integrate security scanning into the CI/CD pipeline. Which tool should you use to scan container images for vulnerabilities?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud (Option C) is the correct tool for scanning container images for vulnerabilities in a CI/CD pipeline, as it integrates with Azure Container Registry to perform vulnerability assessments. Option A (Azure Monitor) is incorrect because it is a monitoring and observability service, not a security scanner. Option B (GitHub Copilot) is incorrect as it is an AI code completion tool. Option D (Azure Logic Apps) is incorrect because it is a workflow automation service, not a security scanning tool.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Monitor
Why it's wrong here
Azure Monitor is a telemetry and alerting service that collects metrics, logs, and activity from Azure resources, but it does not inspect container image contents or identify known vulnerabilities (CVEs). Its purpose is operational health monitoring, not security posture assessment, so it cannot serve as the image scanning control in a DevSecOps pipeline.
- ✗
GitHub Copilot
Why it's wrong here
GitHub Copilot is an AI-powered code completion tool that suggests code snippets based on context, but it does not perform static analysis on existing code or scan container images for known vulnerabilities. It may help developers write more secure code, yet it lacks the ability to detect misconfigurations or CVEs in built artifacts, making it unsuitable for vulnerability scanning.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud, specifically through Microsoft Defender for Containers, includes vulnerability scanning for container images in Azure Container Registry (ACR) and other registries. It uses Microsoft Defender Vulnerability Management to detect OS and language-level CVEs and can be integrated into a CI/CD pipeline as a quality gate, blocking vulnerable images from being promoted to production.
- ✗
Azure Logic Apps
Why it's wrong here
Azure Logic Apps is a workflow automation platform that orchestrates APIs, connectors, and custom actions across cloud and on-premises services, but it does not natively scan container images for vulnerabilities. While you could use Logic Apps to call external scanners, it is not itself a security assessment tool and cannot replace dedicated image scanning services.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Monitor
Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.