Roadmap222 words
Unit 4 — Security and compliance — roadmap
Unit 4 — Develop a security and compliance plan
Exam weight: 10–15% · 3 topics · 17 learning objectives
The through-line: remove the credential wherever possible, and where you cannot, shrink its blast radius and lifetime.
| Topic | Objectives | Core idea |
|---|---|---|
| 4.1 Authentication and authorization | 7 | Prefer identities with no secret to store |
| 4.2 Sensitive information | 4 | The strongest control is having no secret |
| 4.3 Security and compliance scanning | 6 | Prevent at the boundary; alert continuously |
The four things to carry
- Managed identity where the workload runs on Azure; workload identity federation where it does not. System-assigned dies with the resource; user-assigned is shared.
- OIDC issues a short-lived token valid for a single job, and its claims are the authorisation surface — scope the cloud trust to repository and environment, not the organisation.
- Key Vault keys never leave the vault; secrets are retrieved. That decides any "private key must never be exposed" scenario.
- Dependabot alerts inform, security updates fix vulnerabilities, version updates fix staleness — and
dependabot.ymlconfigures only the third.
Two ordering facts
- Deny beats Allow, and Not set means inherit.
- GHAS scans; Defender for Cloud aggregates. A connector without GHAS gives inventory and no findings.