You have an Azure subscription that contains an Azure Container Registry named Registry1. The subscription uses the Standard use tier of Azure Security Center. You upload several container images to…

Question

Options

• AFrom the Azure portal modify the Pricing tier settings.
• BFrom Azure CLI, lock the container images.
• CUpload the container images by using AzCopy.
• DPush the container images to Registry1 by using Docker

• A
  74% (32)
• B
  16% (7)
• C
  2% (1)
• D
  7% (3)

Explanation

Explanation

Upgrading the Pricing tier to Azure Defender (Standard tier with Azure Defender for container registries enabled) is required to enable automatic vulnerability scanning of container images pushed to Azure Container Registry. The Standard tier of Security Center alone does not include container image scanning - you must enable Azure Defender for container registries, which is done by modifying the Pricing tier settings in the Azure portal to include this add-on protection.

Why the distractors are wrong:

• Option B (locking container images via CLI) is a governance/immutability feature that has nothing to do with vulnerability scanning.
• Option C (using AzCopy) is a file/blob transfer tool, not designed for container images, and changing the upload method would not trigger security scans.
• Option D (using Docker push) is already the standard method for pushing container images - the scanning issue is not related to how images are uploaded, but to whether the correct security tier is enabled.

Memory Tip: Think of it this way - "No plan, no scan." If your Azure Security Center pricing plan doesn't include Azure Defender for container registries, no scanning will occur regardless of how you upload images. Always check the pricing/plan tier first when security features are missing.

No community discussion yet for this question.