AZ-400 Practice Question: Design and implement build and release pipelines
Your team uses GitHub Actions to build a multi-container application. The build must produce container images that are scanned for vulnerabilities and signed. Which THREE actions are required in the workflow?
⚠ Common exam trap
The trap is including generic workflow steps (checkout, login) that are helpful but not the specific actions that perform scanning and signing — the exam wants the three steps that directly satisfy the stated security requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a step to run a container scan tool like Trivy.
Option B is correct because the requirement explicitly states the images must be scanned for vulnerabilities, and adding a step that runs a scanning tool such as Trivy (e.g., aquasecurity/trivy-action) performs that vulnerability scan against the built image. Option C is correct because the requirement also states the images must be signed, and cosign (sigstore/cosign) is the standard tool for signing container images, producing a signature that can be verified against the image digest. Option E is correct because a multi-container application must actually be built and pushed to a registry before it can be scanned or signed, and docker/build-push-action is the canonical GitHub Actions step that builds and pushes the images. Option A is not required because authenticating to Docker Hub is only necessary if pushing to Docker Hub specifically; the scenario does not mandate that registry, and authentication could be handled differently or target another registry. Option D is not required for the stated goals because checking out the code is a general prerequisite for many workflows but is not one of the three actions specifically needed to scan and sign the produced images.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the docker/login-action to authenticate with Docker Hub.
Why it's wrong here
The docker/login-action authenticates the workflow to a container registry such as Docker Hub, enabling push/pull of images. While necessary for pushing images and retrieving base images, it does not itself scan or sign the built image, so it cannot fulfill a requirement for vulnerability scanning or image signing.
- ✓
Add a step to run a container scan tool like Trivy.
Why this is correct
Adding a step to run Trivy scans the container image for known vulnerabilities in OS packages and application dependencies. Trivy integrates into GitHub Actions via aquasecurity/trivy-action, can fail the build based on severity thresholds, and generates a SARIF report for GitHub code scanning, making it the correct step for a security scanning requirement.
- ✓
Add a step to sign the container image using cosign.
Why this is correct
Cosign is a tool for signing container images using keyless signing with OIDC, which provides tamper-evidence and provenance for the image. Adding a cosign step after build ensures supply chain integrity, but it is not a vulnerability scanner—so while valid for signing, it does not address scanning.
- ✗
Use the actions/checkout action to checkout the code.
Why it's wrong here
The actions/checkout action is used to fetch the repository source code into the runner workspace, which is a prerequisite for any build. However, it does not perform any security scanning or container image signing, so it is not the specific step required to satisfy a vulnerability scan/compliance check.
- ✓
Use the docker/build-push-action to build and push images.
Why this is correct
The docker/build-push-action builds the container image and pushes it to a registry, commonly using a Dockerfile or buildx and a cache. This is essential for producing the artifact, but it does not perform security scanning or signing by itself; those require separate dedicated steps like Trivy and cosign.
Go deeper
Related to this question
About these practice questions
This AZ-400 question is part of Courseiva's 696-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.