Instiq
Chapter 4 · Develop a Security and Compliance Plan·v2.0.0·Updated 6/3/2026·~11 min

What's changed: Deepened AZ-400 Chapter 4 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)

4.1Integrating Security into Pipelines (DevSecOps)

Key points

Understand shifting security left—SAST/DAST, dependency scanning, container image scanning, IaC scanning, and GitHub Advanced Security. Detect vulnerabilities early in the pipeline.

DevSecOps shifts security left (earlier). Embed scans in the pipeline to stop vulnerabilities before production.

4.1.1Types of scanning

Diagram embedding DevSecOps scans in the pipeline: at commit/build, run SAST (static analysis finds source vulnerabilities), dependency scanning (known OSS vulnerabilities = SCA), IaC scanning (template misconfigurations), and container image scanning (image vulnerabilities); against the deployed runtime, run DAST (dynamic analysis); integrated via GitHub Advanced Security (code scanning/secret scanning/dependencies), halting the pipeline if any fails a threshold—shift-left flow.
Security integrated into the pipeline
  • SAST: static analysis to find source-code vulnerabilities (pre/during build).
  • Dependency scanning (SCA): detect known vulnerabilities in OSS libraries.
  • Container/IaC scanning: detect image vulnerabilities and template misconfigurations.
  • DAST: dynamic analysis on a running app post-deployment.
Exam point

Common on AZ-400: static source analysis = SAST, known OSS vulnerabilities = dependency scanning (SCA), dynamic analysis of running app = DAST, container/IaC misconfig = image/IaC scanning, integration on GitHub = Advanced Security (code/secret/dependency). Earlier (left) detection lowers fix cost.

Continue reading — free sign-up

You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.

Get started freeLog in