3. Secure Storage, Databases, and Networking (25-30%)

This is the exam's highest-weighted domain, and it's worth pausing on why: storage, databases, and network services are where data actually lives and moves, which makes them the most common target regardless of how well identity and governance (Phase 2) are configured upstream. Every control here builds directly on Phase 2 patterns — managed identities authenticating to storage instead of connection strings, private endpoints extending the network-isolation model first introduced for Key Vault.