What's changed: Created SC-100 Chapter 1 (Domain 1 "Design solutions that align with security best practices and priorities": Zero Trust 3 principles/6 pillars/Conditional Access/RaMP; MCRA/MCSB/Defender for Cloud/Secure Score/defenses by attack type; CAF/WAF/Azure landing zones/Azure Policy/DevSecOps/workload identity; resiliency/business-critical assets/BCDR/immutable backups/Azure Backup/Site Recovery/ransomware priorities/security updates).
1.4Resiliency, BCDR, and ransomware defense
Understand a security strategy aligned to business resiliency goals, identifying and prioritizing threats to business-critical assets, secure backup & restore (BCDR) for hybrid/multicloud, ransomware mitigation (prioritizing BCDR and privileged access), and evaluating security updates.
The ultimate goal of security is to keep the business running. Architects work backward from business resiliency goals—what must be protected for the business to continue, and how quickly it can recover after an attack. Ransomware is the most realistic top threat.
1.4.1Identifying and prioritizing critical assets
You cannot protect everything equally. First identify business-critical assets (systems/data whose loss halts the business) and prioritize threats by impact. This focuses limited investment on protecting and recovering the highest-loss assets. Architects use this prioritization as the basis for subsequent BCDR and privileged-access design decisions.
1.4.2Secure backup & restore (BCDR)
The heart of BCDR is that "attackers cannot destroy the backups too." Design immutable, deletion-locked backups, storage isolated from production, and regular restore testing. For hybrid/multicloud, build a recovery plan around Azure Backup / Azure Site Recovery that also covers on-prem and other-cloud assets. Assuming backups themselves are targeted (assume breach), apply privileged-access protection and MFA to backup operations.
1.4.3Ransomware priorities and update management
Microsoft best practices make the ransomware priorities explicit: (1) prepare to recover (recover without paying ransom via verified immutable backups), (2) limit lateral movement (protect privileged access, least privilege, MFA to prevent credential takeover), and (3) make entry harder (patching, posture). Architects advise prioritizing BCDR and privileged access first. Also design a process to evaluate and apply security updates (patches) to close known-vulnerability windows.
If asked "top priority" for ransomware: verified immutable backups (BCDR) and protecting privileged access. "Backups got encrypted" scenario = immutable + isolated from production + restore testing. "Protect the most important first" = identify business-critical and prioritize by impact.
Watch the mix-ups: (1) Design backups beyond "taking" them—immutability, isolation, restore testing (merely taking them won’t prevent ransom). (2) Availability (BCDR) and confidentiality (encryption) are different goals—both needed. (3) Do not confuse Azure Backup (backup) with Azure Site Recovery (failover/replication).
1.4.4Section summary
- Identify business-critical assets and prioritize threats by impact = the basis for investment
- BCDR = immutable, isolated, restore-tested backups (Azure Backup/Site Recovery); protect backup operations too
- Ransomware top priority = verified immutable backups + privileged-access protection, then patching/posture
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Per Microsoft best practices for ransomware, which design prioritizes recovery capability first?
Q2. What is the most appropriate starting point for allocating limited security investment?
Q3. After BCDR, what should be prioritized to limit attacker lateral movement and credential takeover in ransomware?
Q4. For disaster recovery via failover/replication of workloads including on-prem and other clouds, which fits best?
Q5. To close ransomware entry windows from known vulnerabilities, which process should be continually designed?