AZ-400 Practice Question: Design and implement build and release pipelines
Your team uses GitHub Actions to build a multi-container application. The build must produce container images that are scanned for vulnerabilities and signed. Which THREE actions are required in the workflow?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a step to run a container scan tool like Trivy.
To produce container images that are scanned for vulnerabilities and signed, the workflow must include steps to scan the image (e.g., using Trivy), sign the image (e.g., using cosign), and build and push the image (e.g., using docker/build-push-action). Option A is not required because authenticating to Docker Hub specifically is not necessary if the target registry is not Docker Hub. Option D is not strictly required; checking out the code is a common first step but could be done differently or may already be available.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the docker/login-action to authenticate with Docker Hub.
Why it's wrong here
The docker/login-action authenticates the workflow to a container registry such as Docker Hub, enabling push/pull of images. While necessary for pushing images and retrieving base images, it does not itself scan or sign the built image, so it cannot fulfill a requirement for vulnerability scanning or image signing.
- ✓
Add a step to run a container scan tool like Trivy.
Why this is correct
Adding a step to run Trivy scans the container image for known vulnerabilities in OS packages and application dependencies. Trivy integrates into GitHub Actions via aquasecurity/trivy-action, can fail the build based on severity thresholds, and generates a SARIF report for GitHub code scanning, making it the correct step for a security scanning requirement.
- ✓
Add a step to sign the container image using cosign.
Why this is correct
Cosign is a tool for signing container images using keyless signing with OIDC, which provides tamper-evidence and provenance for the image. Adding a cosign step after build ensures supply chain integrity, but it is not a vulnerability scanner—so while valid for signing, it does not address scanning.
- ✗
Use the actions/checkout action to checkout the code.
Why it's wrong here
The actions/checkout action is used to fetch the repository source code into the runner workspace, which is a prerequisite for any build. However, it does not perform any security scanning or container image signing, so it is not the specific step required to satisfy a vulnerability scan/compliance check.
- ✓
Use the docker/build-push-action to build and push images.
Why this is correct
The docker/build-push-action builds the container image and pushes it to a registry, commonly using a Dockerfile or buildx and a cache. This is essential for producing the artifact, but it does not perform security scanning or signing by itself; those require separate dedicated steps like Trivy and cosign.
Go deeper
Related to this question
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.