A vulnerability scan must complete before an image becomes pullable. Which ACR feature gates this?
- A Retention policy
- B Quarantine policy (correct answer)
- C Soft delete
- D Base image update trigger
Shortcut: With quarantine enabled, a pushed image is invisible to normal pulls until a scanner marks it as passed. Only identities with the quarantine reader role can pull it in the interim.