Shift-Left Security (DevSecOps)

AZ-400 path: Implement security and validate code bases for compliance — start here.

Overview

Introduces the DevSecOps mindset: embedding security into the earliest stages of the DevOps lifecycle instead of treating it as a release-time gate. Sets up the “validate code for compliance” theme of this path: automation, shift-left, and continuous compliance.

Learning objectives

• Explain how DevSecOps embeds security throughout the pipeline (shift-left).
• Identify the security checks that belong in commit/build vs release.
• Understand how continuous, automated security replaces manual, end-of-delivery review.

Units

• What is DevSecOps / why shift-left
• Security tooling in the CI/CD pipeline (automated scans)
• Culture & process: shared responsibility, security as code
• Mapping checks to pipeline stages (SAST at PR/build, DAST at deploy, SCA & secrets everywhere)

Concepts introduced

• DevSecOps
• SAST
• DAST
• SCA
• Dependency/vulnerability scanning
• Secret scanning
• Compliance gates (the enforcement mechanism)

Key terms & commands

Shift-left · security as code · SAST vs DAST vs SCA · gate · DevSecOps · “fail fast”

Hands-on

⚠ verify — add an exercise placing a simple scan (coverage or lint) at the build and observing it block a bad commit.

Exam focus

• DevSecOps mantra: shift-left, security embedded & automated, not a final review.
• Distinguish SAST (source, no execution) vs DAST (running app) vs SCA (components/licenses) vs secret scanning (credentials).
• Compliance is enforced by automated gates in the pipeline, not manual audit.

Related

Path MOC · static-and-dynamic-analysis · dependency-scanning · compliance-and-secret-management