Design solutions that align with security best practices and priorities
Start with strategy, not products
Zero Trust rests on three principles: verify explicitly, use least privilege access, and assume breach. Every design decision on this exam can be defended by mapping it to one of the three. The Microsoft Cloud Adoption Framework (CAF) supplies governance and landing-zone structure; the Well-Architected Framework security pillar supplies design trade-offs; the Microsoft Cybersecurity Reference Architectures (MCRA) supply the capability map showing how identity, endpoint, network, and data controls reinforce each other.
Know the shared responsibility model precisely: in IaaS you own the guest OS and everything above it; in PaaS you own data, identities, and configuration; in SaaS you own data and access. A question that moves a workload from IaaS to PaaS shifts controls to Microsoft - the correct answer usually removes a control you no longer need rather than adding one.
Traps: Microsoft Secure Score is a comparative hygiene metric against Microsoft baselines, not evidence of regulatory compliance, and a perfect score does not make breach impossible. Zero Trust is a strategy, not a purchasable SKU. "Assume breach" does not mean assuming nothing works - it means designing segmentation, least privilege, and detection so compromise is contained and visible.
Rule of thumb for prioritization questions: identity first (it is the control plane for everything else), then reduce attack surface, then segment and detect under an assume-breach posture, then automate response.
Worked example: a legacy on-premises app must be exposed to partners. Reject "publish RDP through the firewall." Instead: Entra ID authentication with Conditional Access, Application Gateway with WAF, a Private Endpoint to the backend, and Defender for Cloud posture monitoring - identity, exposure, segmentation, detection.