Revision

A client wants to implement a Zero Trust security strategy that’s based on the three key principles: verify explicitly, least privilege access, and assume breach. As they consider their strategy, what elements/pillars should they account for to provide an end-to-end Zero Trust security strategy. What are examples of the types of security considerations they should contemplate for each element/pillar?

Answer explanation

Should include the six pillars: identities, devices, applications, data, infrastructure, and networks. Refer to the content to see explicit examples for each. This topic will be revisited in subsequent learning paths/modules as you further explore identity, security, and compliance

The shared responsibility identifies which security tasks are handled by the cloud provider, and which ones are dealt with by you, the customer. The responsibilities vary depending on where the workload is hosted. For each approach to hosting (on-premises datacenter, IaaS, PaaS, and SaaS) describe the types of security responsibilities that would be owned by the customer versus those of the cloud provider

Answer explanation

The responses should show that, as the customer moves from on-premises to IaaS to PaaS to SaaS, more of the responsibility shifts to the cloud provider. Importantly, the answer should also reflect that, regardless of which hosting is used, the customer always owns information and data, devices, and accounts and identities.

Defense in depth uses a layered approach to security, rather than relying on a single perimeter. What are examples of security layers and the security measures that can be taken for each layer described?

Answer explanation

Should include the layers from the training content: physical security, identity and access, perimeter, network, compute, application, and data. Refer to the training content for some examples of the types of security measures that can be applied to each.

The CIA triangle is a way to think about security trade-offs. Identify what each letter stands for and describe what they refer to.

Answer explanation

Should include the terms confidentiality, integrity, and availability. Refer to the training content for a description of what is referred to by each of these three components

Identity has become the new security perimeter. Describe what is meant by this and the drivers that have led to a shift from a traditional perimeter-based security model to establishing identity as the new security perimeter?

Answer explanation

Should include a statement that defines an identity and the drivers that have led to this concept. This should include the acceleration in number of people working from home; SaaS applications that are hosted outside of the corporate network; the use of personal devices to access corporate resources; the use of unmanaged devices by partners and customers who may need to access your corporate resources; proliferation of IoT devices―and more.

Describe the different identity types supported by Microsoft Entra and when you would use them.

Answer explanation

Should include the following identity types: user, service principal, managed identity, and device. When describing the user identity type, the response should include the different external identities supported by Microsoft Entra (B2B and B2C). The response should reference the point that a service principal is like an identity for an application. For a managed identity, there should be reference to system-assigned and user-assigned and some of the differences. For a device identity type, there should be reference to the multiple options for getting devices into Microsoft Entra.

You friends just started a small business and are using a free tier of Microsoft Entra ID. They want to increase security but don’t know where to start and are on a very limited budget. They know that you just received your Microsoft Security, Compliance, and Identity Fundamentals certification, so they reach out for some guidance. What would you suggest and why?

Answer explanation

Should include a statement about security defaults in Microsoft Entra, and some of its features, including enforcing multifactor authentication registration for all users. Additionally, the answer should state that security defaults are available as part of the free tier of Microsoft Entra.

Your customer is looking to implement an extra layer of security before allowing authenticated users to access data or other assets. They need the ability to manage and control access to resources based on different conditions/signals. Which Microsoft Entra feature would you recommend―describe how that feature works and its benefits?

Answer explanation

Should describe Conditional Access in Microsoft Entra and include a statement about how signals are used to make decisions, and the analogy to if/then statements that might be included. The answer should also reference the different types of signals and the decisions that can be made based on those signals. Lastly, the answer should reference the fact that Conditional Access is implemented through policies that are created in Microsoft Entra. Bonus points could be awarded if they tie the benefits back to Zero Trust methodology

Your customer is facing challenges in managing employee and business partner access to corporate resources, at scale. There have been issues with people having access for much longer than they need it. The customer already has Microsoft Entra P2 premium licensing, so which features of Microsoft Entra would you recommend and why?

Answer explanation

Should include a statement that references entitlement management and its benefits, including the ability to manage access for internal and external users, and create access packages, and access reviews. Refer to the training content for details.

Your customer is looking for a solution to detect and remediate identity-related risks. They already have Microsoft Entra P2 premium licensing, so what solution would you offer and why? Also describe the capabilities the solutions offer

Answer explanation

Should include a statement that references Microsoft Entra Identity Protection and describe the tasks: the ability to automate and remediate identity-based risks, investigate risks, and export risk detection data to third-party utilities for analysis. Also describe the types of risks―sign-in and user risk―that can be detected and the type of reports the solution provides. Refer to the training content for more details.