What's changed: Deepened SC-900 Chapter 1 to the AZ-900 baseline (Zero Trust three principles + defense-in-depth layers, shared responsibility, CIA table, AuthN/AuthZ order, three auth factors + MFA, encryption/hashing table, scenarios, FAQ, traps). Localized 2 figures
1.1Zero Trust and Defense in Depth
Understand core security ideas—Zero Trust, defense in depth, the shared responsibility model, and confidentiality/integrity/availability (CIA). The starting point for SC-900.
In the cloud era, the old "inside is safe, outside is dangerous" perimeter model is not enough: remote work and cloud usage have spread data and users beyond the corporate network. Zero Trust changes the premise—"trust no request unconditionally, wherever it comes from." For SC-900, connect this core idea to the defense in depth, shared responsibility, and CIA that support it.
1.1.1Zero Trust
Zero Trust, under the motto "never trust, always verify," rests on three principles. These are not separate technologies but a set of guidelines applied together on every access.
- Verify explicitly: always authenticate and authorize, regardless of location.
- Least privilege: grant just-enough access only.
- Assume breach: design to minimize the blast radius.
1.1.2Defense in depth
Defense in depth splits protection into multiple layers so that if one is breached, the next stops the attack. Each layer applies a different control, so an attacker must get through all of them. Typical layers: physical (locked datacenters) → identity & access (authentication, MFA) → perimeter (DDoS protection, firewalls) → network (segmentation) → compute (endpoint/server hardening) → application → data (encryption). The ultimate target to protect is the data at the center; Zero Trust and defense in depth complement each other.
1.1.3Shared responsibility and CIA
The shared responsibility model splits cloud security duties between the provider (Microsoft) and the customer. The boundary shifts across IaaS / PaaS / SaaS, changing what the customer manages. But in all models, data, accounts/identities, and access management essentially remain the customer’s responsibility—repeatedly tested in SC-900. Physical datacenter protection is always the provider’s.
The goals of information security are the CIA triad: Confidentiality (only authorized people can see it—encryption, access control), Integrity (data stays unaltered and correct—hashing, signing), and Availability (usable when needed—redundancy, backups, DDoS protection). Most controls can be organized by which of these three they protect.
| Pillar | Meaning | Typical controls |
|---|---|---|
| Confidentiality | Only authorized can see | Encryption, access control |
| Integrity | Unaltered, correct | Hashing, digital signatures |
| Availability | Available when needed | Redundancy, backups, DDoS protection |
Scenario: secure remote access. For an employee reaching internal data from a home PC, verify explicitly (MFA), grant only what the role needs (least privilege), and limit impact if the device is compromised (assume breach with segmentation). Encrypt traffic (confidentiality), detect tampering via logs (integrity), and prevent outages with redundancy (availability). Zero Trust, defense in depth, and CIA work as one.
Watch the mix-ups: (1) Zero Trust (a mindset changing the trust premise) vs defense in depth (a layered method)—different but complementary. (2) Under shared responsibility, even in SaaS, data, identity, and access management remain the customer’s—not "all handled because it’s cloud." (3) The CIA triad does not include cost or speed.
Q. Zero Trust vs defense in depth? Zero Trust is the "trust nothing unconditionally" mindset; defense in depth is the "protect in layers" method—used together. Q. Where is the customer’s responsibility largest under shared responsibility? IaaS; smallest in SaaS, but data and identity still stay with the customer. Q. Which Zero Trust principle is MFA? A key implementation of "verify explicitly."
Common: Zero Trust’s three principles (verify explicitly / least privilege / assume breach), the CIA triad, defense-in-depth layers, and the shared responsibility model. "Never trust, always verify" is the motto; under shared responsibility, data and identity stay with the customer even in SaaS.
1.1.4Section summary
- Zero Trust = verify explicitly / least privilege / assume breach
- Defense in depth to protect, shared responsibility to split duties, CIA as the three pillars
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which best captures the Zero Trust motto?
Q2. Which is NOT part of the CIA triad of information security?
Q3. Which idea protects across multiple layers so one failure is not enough?