Question

A retail company runs its e-commerce platform on Azure Kubernetes Service (AKS). The security architect must design controls that (1) prevent deployment of container images with known critical vulnerabilities, (2) detect runtime threats such as web shell activity and crypto-mining inside running pods, and (3) enforce Kubernetes hardening recommendations like blocking privileged containers. The solution should minimize custom tooling and integrate with the organization's existing Defender for Cloud posture. Which combination of controls best meets these requirements?

Accepted Answer

Enable Defender for Containers with the agentless registry vulnerability scanning and the Defender sensor (agent), and enforce admission control through Azure Policy for Kubernetes (Gatekeeper) deny effects.

Answer

Deploy a third-party open-source image scanner in the CI pipeline and rely on Azure Network Security Groups to block malicious pod traffic at runtime.

Answer

Enable Microsoft Defender for App Service and apply Azure Firewall egress rules to prevent crypto-mining connections from the cluster.

Answer

Turn on Defender for Servers Plan 2 on the AKS node pool VMs and use Windows LAPS to rotate node credentials for hardening.