1.1. The Core Security Mindset
💡 First Principle: Security exists to protect three things — confidentiality (only the right people can read it), integrity (nobody can change it without detection), and availability (the right people can get to it when they need it) — and every security control you'll study is really just a way of protecting one or more of those three properties.
This is the CIA triad, and it's worth internalizing because it reframes how you read exam questions. When a question describes encryption, it's protecting confidentiality. When it describes hashing or audit logging, it's protecting integrity. When it describes DDoS protection or backup, it's protecting availability. Instead of memorizing "what does Azure Key Vault do," you can ask "which of the three properties is this scenario protecting?" and reason toward the answer.
Underneath the triad sit three related terms that the exam uses precisely: a vulnerability is a weakness (an unpatched server, a weak password policy), a threat is anything that could exploit that weakness (an attacker, malware, a natural disaster), and risk is the likelihood and impact if a threat successfully exploits a vulnerability. Security controls exist to reduce risk — by closing vulnerabilities, by blocking threats, or both.
⚠️ Exam Trap: Don't confuse a vulnerability with a threat. A weak password is a vulnerability; the attacker guessing it is the threat. Risk is what happens when the two meet.
Reflection Question: If a company's data is encrypted but an attacker can still delete every backup, which leg of the CIA triad failed, and why did encryption not help?
