AZ400-Q: release a trusted container image
A deployment should use the exact container image tested in CI, not whatever currently carries the
latesttag. What should the pipeline record and deploy?
- A) An immutable image digest or versioned image reference linked to the build, scan, and source provenance. ✓
- B) The
latesttag only. - C) A screenshot of the registry.
- D) A random image selected at deploy time.
Answer: A. Immutable image identity supports reproducibility, scanning evidence, and rollback selection.
Why not the others: latest, screenshots, and random selection are mutable or unverifiable.