MCS flashcards
MCS · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Confidentiality, Integrity, Availability
- The CIA triad: confidentiality keeps data readable only by authorized parties, integrity keeps data accurate and unaltered, and availability keeps systems accessible to legitimate users when needed.
- Defense in depth
- A layered security strategy placing controls at physical, identity, network, compute, application, and data levels so a single failed control does not expose the whole asset.
- Zero Trust model
- A security approach that verifies every request explicitly, grants least privilege, and assumes breach, so no user or device is trusted based solely on network location.
- Shared responsibility model
- A division of security duties: the cloud provider secures physical hosts and infrastructure, while the customer remains responsible for data, identities, access, and configuration.
- Authentication vs authorization
- Authentication verifies who a principal is, such as by password or token; authorization determines which resources and actions that authenticated principal is permitted to use.
- Encryption vs hashing
- Encryption is reversible with a key and protects data at rest or in transit; hashing is one-way, used for integrity checks and password storage, and cannot be reversed.
- Compliance vs governance
- Compliance means meeting external laws, regulations, and standards; governance is the internal policies, roles, and controls that keep the organization aligned with those obligations.
- Microsoft Entra ID
- Microsoft's cloud identity provider that authenticates users and applications and issues tokens for access to Microsoft 365, Azure, and integrated applications.
- Conditional Access
- An Entra ID policy engine that evaluates sign-in signals such as user, device, location, and risk, then grants, requires controls like MFA, or blocks access.
- Entra roles vs Azure RBAC
- Entra ID roles manage directory objects such as users and groups; Azure role-based access control manages actions on Azure resources at scopes like subscription or resource group.
- Multi-factor authentication
- Authentication requiring factors from at least two distinct categories, such as a password plus an authenticator app code, so a stolen password alone is insufficient.
- Self-service password reset
- An Entra ID feature letting users reset or unlock their own accounts after verifying identity with configured methods, reducing helpdesk load and lockout delays.
- Privileged Identity Management
- An Entra ID service providing just-in-time activation, approval workflows, and access reviews for privileged roles, replacing permanent standing administrative access.
- Identity Protection
- An Entra ID service that detects risky sign-ins and users, assigns risk levels, and can drive Conditional Access policies that require remediation or block access.
- Hybrid identity
- A configuration connecting on-premises Active Directory to Entra ID through synchronization or federation, so users use one credential across both environments.
- External identities
- Entra ID features for partners and customers, including B2B collaboration for guest access and External ID for customer-facing applications, without internal account creation.
- Microsoft Defender for Cloud
- A cloud security service combining posture management with Secure Score recommendations and workload protection for servers, storage, containers, and databases.
- Microsoft Sentinel
- A cloud-native SIEM and SOAR platform that ingests logs, detects threats with analytics rules, and automates response using playbooks built on Logic Apps.
- Defender XDR
- Microsoft's extended detection and response service that correlates signals from identities, endpoints, email, and cloud apps into unified incidents for faster investigation.
- Defender for Endpoint
- An endpoint security service providing threat detection, attack surface reduction, and automated investigation and response for managed devices such as laptops and servers.
- Defender for Office 365
- An email and collaboration protection service using Safe Links, Safe Attachments, anti-phishing, and anti-spam policies to block malicious content in Microsoft 365.
- Defender for Cloud Apps
- A cloud access security broker that discovers shadow IT, governs sanctioned apps, and applies session and app-control policies to cloud application usage.
- Secure Score
- A Defender for Cloud metric scoring an environment against recommended security controls, where implementing more recommendations raises the score and improves posture.
- Defender for Identity
- A security service monitoring on-premises Active Directory signals to detect identity-based attacks such as credential theft, reconnaissance, and lateral movement.
- Microsoft Purview
- A compliance family covering data classification, sensitivity and retention labels, data loss prevention, eDiscovery, audit, and insider risk management across Microsoft 365.
- Sensitivity labels
- Purview labels that classify content and can apply encryption and content marking; the protection travels with the file even when shared outside the organization.
- Retention labels and policies
- Purview controls that keep, delete, or retain-then-delete content for defined periods; event-based labels can start retention from a trigger such as a contract end date.
- Data Loss Prevention
- Purview policies that detect sensitive information types and warn, block, or restrict sharing across email, SharePoint, OneDrive, Teams, and endpoint devices.
- eDiscovery
- A Purview capability to search, preserve, and export content for legal cases; Premium adds custodian management, review sets, and analytics beyond standard search.
- Compliance Manager
- A Purview tool that maps controls to regulations, tracks improvement actions, and calculates a compliance score reflecting progress toward assessment requirements.
- Microsoft Priva
- A privacy management product supporting subject rights requests, privacy risk assessment, and consent or tracking controls for personal data across the organization.
- Purview Audit
- A logging capability recording user and administrator activity; Standard provides default retention, while Premium adds longer retention and higher-fidelity events for investigations.