Microsoft Defender for Containers integrates with ACR to scan images. When does scanning occur?

1. A Only when explicitly triggered
2. ✓ B On push and on import; also periodic re-scanning (correct answer)
3. C Only when pulled from a running AKS cluster
4. D Only on Premium SKU registries during push

Shortcut: Defender for Containers scans on push (via quarantine/webhook), on import, and periodically re-scans already-stored images for new CVEs.