1.2.1. Prevention vs. Detection vs. Response
💡 First Principle: Prevention stops a bad action from happening; detection notices it happened anyway; response contains and reverses the damage. Every control on the exam does one of these three jobs, and most exam scenarios are really asking "which job is missing here."
| Platform | Primary Job | Example Control |
|---|---|---|
| Microsoft Entra ID | Prevention | Conditional Access blocking a risky sign-in before authentication completes |
| Azure Key Vault | Prevention | Access policies and firewall rules stopping unauthorized secret retrieval |
| Microsoft Defender for Cloud | Prevention + Detection | Policy enforcement (prevention) and workload protection alerts (detection) |
| Microsoft Sentinel | Detection + Response | Correlating signals into incidents; automation rules and playbooks for response |
| Microsoft Security Copilot | Response acceleration | Summarizing an incident and suggesting next steps across connected data sources |
⚠️ Exam Trap: Don't assume Defender for Cloud and Microsoft Sentinel are competing products where you'd pick one. Defender for Cloud is a data source (posture findings, workload alerts) that commonly flows into Sentinel as a connector, where it gets correlated with signals from everything else. A scenario describing both in the same environment is normal architecture, not redundancy.
Reflection Question: A workload alert fires in Defender for Cloud, and an analyst wants to automatically trigger a Logic App to isolate the affected resource. Which platform actually owns that automation step?
