MCS study plan

Define the shared responsibility model and state which controls shift to the customer in IaaS, PaaS, and SaaS

Distinguish the three cloud service models and deployment models by who manages the physical, host, and application layers

Map Microsoft Defender for Cloud's posture management versus workload protection capabilities to the threats each addresses

Explain defense in depth and place each Microsoft security layer (identity, network, data, compute) in the correct layer

Compare Microsoft Defender for Cloud secure score, security recommendations, and regulatory compliance views

Describe Microsoft Sentinel's role as a SIEM and SOAR and how data connectors, analytics rules, and automation rules interact

Differentiate Microsoft Defender XDR products (for Endpoint, for Office 365, for Identity, for Cloud Apps) by the signal each ingests

Explain Zero Trust principles and map each to a concrete Microsoft capability

Describe Microsoft Entra ID's role as a cloud identity provider and contrast it with on-premises Active Directory Domain Services

Distinguish tenants, subscriptions, and directories and explain how they relate

Compare the four Entra editions (Free, P1, P2, Governance) by the features each unlocks

Explain authentication methods including passwordless options (FIDO2, Windows Hello for Business, Microsoft Authenticator) and when each applies

Explain how Conditional Access evaluates signals, makes decisions, and enforces controls

Describe multifactor authentication registration and the difference between security defaults and Conditional Access policies

Explain Microsoft Entra ID Protection's risk detections, risk levels, and remediation options

Describe Privileged Identity Management for just-in-time role activation and approval workflows

Explain external identities including B2B collaboration and B2C

Define confidentiality, integrity, and availability and give a Microsoft control that supports each

Explain the difference between authentication, authorization, and accounting

Describe identity as the security perimeter and the roles of the identity provider and the relying party

Distinguish security, compliance, and governance as separate but overlapping disciplines

Explain what a Zero Trust strategy replaces and why perimeter-based security fails for cloud workloads

Describe Microsoft Purview's compliance portal and the solutions it hosts

Explain sensitivity labels, label policies, and how labels drive protection across workloads

Describe data loss prevention policies and the difference between sensitive information types and trainable classifiers

Explain retention labels versus retention policies and how retention and deletion interact

Describe insider risk management and communication compliance as insider-threat controls

Describe Microsoft Purview eDiscovery including content search, holds, and the role of a custodian

Explain audit logging in Purview and how audit retention differs from mailbox auditing

Describe the Microsoft Priva and compliance manager capabilities for privacy and assessment

Explain how regulatory compliance offerings and the Microsoft cloud data residency commitments support compliance obligations

Differentiate data governance, data protection, and privacy responsibilities

Re-derive the domain weightings and allocate remaining study time to the weakest two domains

Complete a timed full-length practice set and log every missed objective by domain

Re-explain each missed objective aloud without notes until accurate

Consolidate the four domain summaries into a single one-page reference sheet