Security, Compliance, and Identity Concepts
The first domain tests whether you can talk about security, compliance, and identity as connected concepts rather than product names. Expect definition and scenario questions that ask you to choose the right principle, not to configure a portal.
Security models you must be able to apply
Under the shared responsibility model, the cloud provider always secures the physical datacenter, but your obligations shift: in IaaS you still patch the guest OS and configure the network; in PaaS the platform patches the runtime; in SaaS you mainly manage data, identities, and device access. Defense in depth stacks independent controls - physical, identity, perimeter, network, compute, application, and data - so one failure does not expose everything. The CIA triad (confidentiality, integrity, availability) is the vocabulary for describing what a control protects. Zero Trust is a strategy, not a product: verify explicitly, use least-privilege access, and assume breach.
Identity vocabulary
Authentication proves who you are; authorization decides what you may do. SSO reduces credential sprawl; MFA adds factors; passwordless methods such as FIDO2 keys remove passwords entirely. Federation lets a trusted identity provider issue claims that another service accepts. Identity is often called the new security perimeter because access now follows the user, not the network.
Compliance, governance, risk
Security protects; compliance demonstrates adherence to requirements (laws, standards, internal policy); governance defines the rules; risk management prioritizes. Data residency and sovereignty constrain where data is stored and who can access it.
Worked example
A consultant's laptop is stolen. Reasoning: full-disk encryption protects the data layer; Entra MFA and Conditional Access protect identity; Defender for Endpoint protects the endpoint layer; DLP limits what could be copied. You would not claim the shared responsibility model alone protects the data - Microsoft secures the service, but the data and credentials are the customer's responsibility.
Traps
Do not merge authentication and authorization; do not treat Zero Trust as an Azure SKU; do not say the cloud provider is responsible for customer data in SaaS; do not confuse compliance attestations with actual security controls.