1. First Principles of Cloud and AI Security

Every domain in this guide is really one idea applied to a different resource type: decide who or what should be trusted, prove that trust continuously, and watch for the moment it's abused. Before touching Entra ID configuration screens or Defender for Cloud dashboards, it's worth locking in that idea, because almost every exam trap in the domains that follow is really a Phase 1 concept in disguise — a scenario question about Key Vault firewall rules is testing the same "verify explicitly" logic as a question about Conditional Access.