Dependency Scanning (SCA & Supply Chain)
AZ-400 path: Implement security and validate code bases for compliance — “Manage dependencies / open-source governance” module.
Overview
Covers software composition analysis (SCA) and dependencies vulnerability management: inventorying the open-source components an app consumes, checking them for known CVEs/advisories, enforcing license policy, and automating remediation (e.g. Dependabot PRs) — all feeding the release.
Learning objectives
- Explain why third-party/transitive dependencies are a security surface.
- Identify how SCA, vulnerability scanning, and license governance differ.
- Use dependency-scanning output as a release gate (critical vuln / banned license → block).
- Automate fix pull-requests (Dependabot) and pair with Azure Artifacts dropping/upstream.
Units
- The software-supply-chain risk & transitive dependencies
- Vulnerability scanning (CVE/advisories) vs SCA (inventory + licenses)
- Tools: Dependabot (GitHub), Open Source / artifact scanning, OWASP Dependency-Check
- Gating releases on dependency & license findings
Concepts introduced
- Dependency vulnerabilities
- Software composition analysis (SCA)
- Compliance gates
- Dependency management (strategy, feeds, versioning)
- Azure Artifacts (package host & upstream)
Key terms & commands
SCA · CVE · advisory · transitive dependency · SBOM / bill of materials · Dependabot · lockfile · gate
Hands-on
⚠ verify — add an exercise enabling Dependabot/vulnerability scanning, reviewing a flagged package, and setting the release gate.
Exam focus
- SCA = components + licenses + inventory vs vulnerability scanning = patch state vs SAST = your code — three-way distinction.
- Transitive deps must be scanned (full graph, not just direct references).
- Policy violation (critical CVE, banned/GPL license) → gate fails the release.
- Automated remediation: Dependabot opens PR to bump versions; prefer update + redeploy on a finding.
Related
Path MOC · shift-left-security · static-and-dynamic-analysis · Dependency-Management path