2. Implement authentication and access management (25–30%)

This is the heaviest domain on the exam, and it maps directly onto Phase 1's spine: the factor ladder becomes the authentication methods policy (2.1), the checkpoint between authentication and authorization becomes Conditional Access (2.2), risk signals feed that checkpoint automatically through ID Protection (2.3), and Global Secure Access extends the same identity-aware decisions to network traffic itself (2.4). Read every scenario in this phase through one question: what signal is being verified, and what control enforces the decision?