1.4. Reflection Checkpoint

Key Takeaways

• Every security control maps back to protecting confidentiality, integrity, or availability (the CIA triad) — use this to reason about unfamiliar scenarios instead of memorizing product lists.
• Vulnerability (weakness), threat (what could exploit it), and risk (likelihood × impact) are distinct, precisely-used terms on this exam.
• Compliance is continuous verification against changing rules and changing environments — not a one-time certificate.
• Governance, risk management, and audit together form GRC, a term formalized in Phase 2.
• Identity has become the primary security perimeter because cloud and remote work removed the traditional network edge — but network-layer controls (Phase 4) still matter as additional layers.

Connecting Forward

Phase 2 takes each of these three first principles and gives it Microsoft's exam-specific vocabulary: the CIA mindset becomes the shared responsibility model and defense-in-depth; the "verify every time" idea becomes Zero Trust formally; and identity-as-perimeter becomes authentication, authorization, identity providers, and federation. If Phase 1's ideas feel solid, Phase 2 will feel like vocabulary-building rather than new concepts.

Self-Check Questions

• Why does "risk" require both a vulnerability and a threat to exist simultaneously — what happens to risk if only one is present?
• Why can't a snapshot-in-time audit prove ongoing compliance, and what would you need instead?
• What replaced the network firewall as the primary trust boundary once resources moved to the cloud, and why?