Exam AZ-400 topic 7 question 37 discussion

No way you should do manual task. And the requirement states "as early as possible" so image registry is the earliest option from the other 3 what left. Answer is correct.

This is a new feature release in March, https://docs.microsoft.com/en-us/azure/security-center/azure-container-registry-integration Now, in your pipeline, trivy/aqua would be the task.

A. a task executed in the continuous integration pipeline and a scheduled task that analyzes the image registry

Why is CI a better place to scan, than in CD? Sure, if it's a known issue, you catch it already in CI step. But what if you run your CI, nothing is found. Then months later you want to deploy your build, or even revert to an old one. Now you are just going to run your CD, but in the meantime, issues could have been found. This will not be detected by running the scan exclusively in build.

https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-cicd "To set up the scanner, you'll need to enable Microsoft Defender for container registries and the CI/CD integration" Answer is A

A is correct answer.

Never do in OnProd env and no manual, so Answer is correct. => image registry

for the correct answer is A. CI and ACR are the places to scan for security issues as early as possible

The answer is looking correct :https://docs.microsoft.com/en-us/azure/security-center/defender-for-container-registries-cicd

why we need to analyze image registry?, it would be faster analyze only required images

Answer looks right, but it is not scheduled. It's done on the every push stage, no ?