A county requires assurance that production App Service pulls only trusted generative API images from Azure Container Registry. What should they emphasize?
Select an answer to reveal the explanation.
Short Explanation
Production pulls should be like accepting only sealed evidence bags—not random boxes off the curb. Content trust or signed/attested ACR images give the county generative API a verification story before App Service runs them.
Full Explanation
Content trust, signing, and attestation workflows help ensure production hosts pull verified images from ACR. A county that requires assurance for generative API images on App Service should emphasize signed or attested image practices so only trusted artifacts run in production. Combined with private registry authentication and scanning, signing/attestation strengthens the supply-chain story for municipal AI containers beyond “someone pushed latest.”
Allowing any unsigned community image tagged latest from the public internet fails trust and version pinning. Skipping registry authentication and pulling over plain anonymous HTTP fails confidentiality and integrity controls. Disabling image scanning and accepting every push without review fails vulnerability and policy gates that complement content trust.
Exam caveat: Exact product names evolve (Docker Content Trust, notation/cosign-style attestations, Microsoft Defender for Containers scanning). The exam concept is verified/trusted images from ACR for production—not anonymous unsigned latest. Scanning and signing are complementary; the stem emphasizes trust/verification of what production pulls.
Operational check: Require production App Service to pull a signed/attested permit or generative API image from ACR with authentication enabled, verify signature/attestation validation in the pipeline or admission policy, and ensure unsigned public latest tags cannot be deployed to the production slot.