Implement Security & Validate Code for Compliance — MOC
MS Learn path: Implement security and validate code bases for compliance · Shift-left security: find issues before they ship.
Map / Canvas
The core idea
Security is embedded throughout the pipeline (DevSecOps / shift-left), not bolted on at release. Code is validated for compliance with automated analysis layered by what it inspects:
- Your code → SAST (source, no execution).
- The running app → DAST (black-box, runtime).
- Components/licenses → SCA + dependency/vuln scanning.
- Credentials → secret scanning.
- Artifacts → code signing for authenticity & integrity.
All findings are enforced by a compliance gate that blocks shipping on violations — making compliance continuous and demonstrated, not audited at the end.
Modules in this path
- Shift-left security (DevSecOps)
- Static & dynamic analysis (SAST & DAST)
- Dependency scanning (SCA & supply chain)
- Compliance & secret management
Concepts (linked from here)
DevSecOps · SAST · DAST · Dependency vuln scanning · SCA · Code signing · Compliance gate · Secret scanning
Skills measured (exam blueprint)
- Implement security and validate code bases for compliance (DevSecOps, SAST/DAST, dependency & secret scanning, code signing, quality gates).
- Integrate defense against code-vulnerability classes and supply-chain risks into pipelines.
Practice
⚠ verify — add practice questions on SAST vs DAST vs SCA, gate behavior, and secret-remediation (revoke/rotate).
Practice questions
- az400-q-sec-001 — SAST vs DAST (shift-left static analysis)
- az400-q-sec-002 — remediating a leaked secret (revoke/rotate, purge history)