1.3. Reflection Checkpoint

Key Takeaways

• Zero Trust replaces location-based trust with continuous, explicit verification — it's an architecture expressed through many controls, not a single product.
• Identity is the primary control point once the network perimeter stops being a reliable trust boundary; a network-hardened resource can still be compromised through a weak identity attached to it.
• Defense in depth means the domains in this guide are additive layers (identity → network → data/platform → compute/AI → visibility), not competing alternatives.
• Five platforms map to three functions: Entra ID and Key Vault prevent, Defender for Cloud spans prevention and detection, Sentinel detects and responds, Security Copilot accelerates response.
• AI workloads inherit every existing security layer and add three new risk categories: oversharing, agent identity/blast radius, and behavioral manipulation (prompt injection).

Connecting Forward

Phase 2 puts these principles to work on the exam's most foundational domain: identity, secrets, and governance. Privileged Identity Management, Conditional Access, and Azure RBAC are the concrete mechanics behind the "verify explicitly" and "least privilege" principles introduced here.

Self-Check Questions

• Why does a defense-in-depth model mean you should almost never remove an existing control just because a newer one seems to overlap with it?
• If you had to explain to a colleague why Sentinel and Defender for Cloud aren't redundant with each other, what would you say?