Security, Compliance, and Identity Concepts
Core vocabulary
Start with the shared responsibility model. Microsoft is always responsible for physical security, hosts, and the network; the customer is always responsible for data, accounts, and devices. Responsibilities in between (operating system, applications, identity) shift with the service model: IaaS gives the customer the most, SaaS the least. Exam traps usually ask who owns patching or identity configuration under a given model.
Defense in depth layers physical, identity, perimeter, network, compute, application, and data controls. A question describing a control at one layer is often answered by naming that layer, not by naming a product.
Zero Trust
Zero Trust rests on three principles: verify explicitly, use least privilege access, and assume breach. Its six pillars are identity, devices, applications, data, infrastructure, and networks. Watch for distractors presenting Zero Trust as a product or as "trust everything inside the firewall" - it is a strategy, and network location grants no implicit trust.
Encryption and governance terms
Know encryption at rest versus in transit, and symmetric versus asymmetric keys. Confidentiality, integrity, availability (the CIA triad) anchor threat modeling; hashing supports integrity, encryption supports confidentiality.
Compliance vocabulary: data residency, data sovereignty, data subject requests (DSRs), and audit trails. Identity vocabulary: authentication (proving who you are) versus authorization (what you may do), plus identity as the new security perimeter.
Rule of thumb
If a stem asks "which concept explains why a stolen password is dangerous even inside the corporate network," answer Zero Trust / assume breach, not a specific firewall feature. Always map the scenario to the concept before the product.
Worked example
A question says a company moves email to a cloud service and asks which responsibility transfers to Microsoft. Under SaaS, Microsoft patches the application and OS; the customer still owns data classification and account hygiene. Answer: application and OS maintenance.