AZ400-Q: secure a container delivery path
A team builds container images in CI. It needs to prevent a known critical dependency vulnerability from reaching production while allowing documented exceptions for non-exploitable cases. What is the best approach?
- A) Scan only the Dockerfile for spelling errors.
- B) Require an extra code-review emoji.
- C) Push every image to production first, then scan it.
- D) Scan dependencies and the built image in CI, enforce a documented severity/exception gate, and retain evidence of the decision. ✓
Answer: D. The design evaluates relevant artifacts before release and makes exceptions explicit, reviewed, and auditable.
Why not the others: Text linting and emoji review do not assess dependency vulnerabilities. Post-production scanning detects risk too late.
Related
github-advanced-security · dependency-vulnerabilities · compliance-gate