2.3. Reflection Checkpoint

Key Takeaways

• Security and compliance controls (shared responsibility, defense-in-depth, Zero Trust, encryption/hashing, GRC) answer both "are we protected" and "can we prove it" at once — they aren't separate tracks.
• The shared responsibility model shifts obligations by service type (IaaS/PaaS/SaaS), but identity, access, and data protection never fully transfer to the provider.
• Zero Trust means continuous, explicit verification — not the absence of granted access.
• Encryption is reversible and protects confidentiality; hashing is one-way and protects integrity or secret storage. They are not interchangeable.
• Authentication (who you are) always precedes authorization (what you can do) — and the exam frequently tests whether you can tell a failure of one from a failure of the other.
• Directory services (store identities), identity providers (authenticate and issue tokens), and federation (extend trust between separate identity systems) are three distinct, related building blocks.

Connecting Forward

Phase 3 takes every identity concept from this phase — authentication, authorization, identity providers, directory services, federation — and shows you exactly how Microsoft Entra ID implements each one, plus the access-management and governance capabilities (Conditional Access, RBAC, PIM, Identity Protection) built on top of them. If a term in Phase 3 feels unfamiliar, it's worth returning here first.

Self-Check Questions

• Why does a well-configured single firewall not qualify as "defense-in-depth," even though it's a real security control?
• If you can't reverse a hash, how does a login system verify a password without ever storing the original password?
• What specific problem does federation solve that a shared password database would not solve safely?