Question

A retail company runs microservices on Azure Kubernetes Service (AKS) and pushes images to Azure Container Registry (ACR) through a CI/CD pipeline. Security architects require that vulnerable container images be identified before deployment and that images with critical, fixable vulnerabilities be blocked from being deployed into the cluster. They want to minimize custom tooling and rely on native Microsoft capabilities. Which combination of Defender for Cloud capabilities should the architects specify?

Accepted Answer

Enable Defender for Containers vulnerability scanning on ACR and at runtime, and configure an Azure Policy admission control (gatekeeper) enforcement to deny deployment of images with critical, fixable findings

Answer

Enable Microsoft Defender for Servers on the AKS agent nodes and use its file-integrity monitoring to detect vulnerable image layers before pods start

Answer

Configure Defender EASM to scan the container registry externally and use Exposure Management attack paths to remove risky images from ACR automatically

Answer

Rely on Secure Score recommendations for AKS and manually remediate flagged images after they are deployed during the weekly posture review