You run AKS clusters and store images in Azure Container Registry (ACR). You need image vulnerability scanning on push to ACR and runtime threat detection from the clusters. What should you do?

The correct solution leverages Microsoft Defender for Containers, which provides both image vulnerability scanning for ACR on push and runtime threat detection for AKS clusters. Enabling the Defender for Containers plan at the subscription level activates these capabilities. The built-in policy initiative ensures the Defender sensor (DaemonSet) is automatically deployed to AKS clusters, facilitating runtime protection. ACR registry scanning, a feature of Defender for Containers, handles the on-push image scanning requirement. Incorrect options: Microsoft Defender for Servers Plan 2 focuses on virtual machines and servers, not specifically container images or AKS runtime threat detection in the required manner. ACR Tasks automate image builds and patching but don't provide vulnerability scanning or runtime threat detection. Azure Monitor VM insights are for VM monitoring, not container runtime security. Azure Monitor alert rules based on Container Insights metrics are for monitoring and alerting, not for comprehensive vulnerability scanning or advanced runtime threat detection. A Defender plan is essential for scanning on push. Azure Firewall provides network security but does not offer image vulnerability scanning or advanced runtime threat detection within containers or AKS nodes.