CertifyDeckCargando contenido…
The official Microsoft Certified: Security, Compliance, and Identity Fundamentals syllabus, organized by domain. Check off each point as you review it.
Inicia sesión para guardar tu progreso entre sesiones.
Describe security and compliance concepts
On-premises, the organization manages the whole stack; with IaaS, PaaS and SaaS the provider takes on more layers (hosts and network, then operating system and runtime, and in SaaS the whole application). Whatever the model, the customer always keeps its data, its identities and access, its devices and its configuration. With AI, the customer remains responsible for usage, access and policies.
Describe the shared responsibility model ↗Shared responsibility in the cloud ↗
Defense in depth uses several overlapping layers of controls so that if one fails the next still protects the data: physical security, identity and access, perimeter, network, compute, application and data. They all serve the CIA triad: confidentiality (only authorized people see data), integrity (data is not altered without authorization) and availability (access when needed).
Zero Trust is a strategy, not a product, based on trusting no one and verifying everything, wherever the request comes from. Its three principles are verify explicitly, use least privileged access and assume breach. It is applied across seven pillars: identities, devices, applications, data, infrastructure, networks, and visibility, automation and orchestration.
Encryption makes data unreadable without the key: symmetric uses the same key to encrypt and decrypt and is fast; asymmetric uses a public and private key pair and enables digital signatures. Data is protected at rest, in transit and in use. Hashing is one-way, uses no keys and acts as a fingerprint; salting protects passwords better. Keys should be stored separately and rotated.
GRC integrates three areas: governance (rules and processes to direct and control activity), risk (identify, assess, respond to and monitor threats; accept, mitigate, transfer or avoid) and compliance (adhering to applicable laws and standards, which sets minimums and is not the same as security). Key concepts: data residency, data sovereignty and data privacy.
Define identity concepts
With cloud apps, remote work, personal devices and partner access, the network perimeter is no longer a reliable boundary, and the question becomes who or what is making each request. That is why identity is the new perimeter. Identities can be human, device, workload or agent, and an identity infrastructure rests on four pillars: administration, authentication, authorization and auditing.
Authentication is the process of proving you are who you say you are, answering the question of who you are. It rests on factors: something you know, something you have and something you are. A single factor, such as a password, is vulnerable; multifactor authentication requires two or more factors from different categories and greatly reduces the risk of account takeover. It confirms identity only, not permissions.
Authorization determines what an already authenticated identity is allowed to do, answering the question of what you are allowed to do. It is based on roles, permissions and attributes, and is always evaluated after successful authentication. The principle of least privilege grants only the minimum access needed, reducing the damage from a compromised account and the risk of accidental data loss.
An identity provider creates and manages identity information and offers authentication, authorization and auditing to applications, which delegate sign-in to it. After verifying credentials it issues security tokens: the ID token proves sign-in and the access token grants permission to a resource. It enables single sign-on, and communicates using OpenID Connect, OAuth 2.0 and SAML.
A directory service stores information about network objects (users, devices, groups, policies, applications) and makes it available to users and applications. Active Directory Domain Services (AD DS) is Microsoft's on-premises directory service; the server that runs it is a domain controller. It was designed for on-premises networks and does not natively support SaaS or OAuth 2.0 and OpenID Connect; Microsoft Entra ID is its cloud evolution.
Describe the concept of directory services and Active Directory ↗Active Directory Domain Services overview ↗
Federation enables access to services across organizations or domains through trust relationships between separate identity providers, so users authenticate with their home credentials and need no new account. Trust is not bidirectional by default and works across vendors thanks to standard protocols. Examples: B2B collaboration, social sign-in and AD FS to extend on-premises AD to the cloud.