Lesson 10 · Domain 2: Azure Architecture & Services (35–40% of exam)

Security Models

Zero Trust and defense-in-depth answer two different questions: Zero Trust asks "should this request, right now, be trusted?" — defense-in-depth asks "if an attacker gets past one layer, what stops them reaching the data?" Microsoft Defender for Cloud is the tool that operationalizes both.

Primary source: Microsoft Learn — Describe Azure identity, access, and security (units 7–9), part of Part 2: Describe Azure architecture and services. Same module as Lesson 9 — this lesson picks up its final three units.

Quick calibration

Two statements about your org's security posture: (1) "Every sign-in is evaluated on its own risk — location, device health, app sensitivity — no matter whether it comes from inside our office network or a coffee shop." (2) "Even if someone breaches our perimeter firewall, they still can't reach customer data directly — they'd have to get through network segmentation, then compute, then the application, then encryption at rest." Which model is statement 1 describing, and which is statement 2?

Zero Trust

Zero Trust assumes breach from the outset and verifies every request as if it originated from an uncontrolled network — no free pass just because a device sits on the office Wi-Fi. It rests on three guiding principles:

PrincipleMeans
Verify explicitlyAlways authenticate and authorize using every available signal, not just network location
Use least privilege accessJust-in-time and just-enough-access, risk-based adaptive policies
Assume breachSegment access to limit blast radius, verify end-to-end encryption, use analytics to detect threats

This flips the traditional model: instead of trusting a device because it's inside a protected perimeter, Zero Trust grants access based on continuous, context-aware evaluation of identity, device, and risk signals — regardless of where the request comes from. You've already met one concrete implementation of this: Conditional Access from Lesson 9 is "verify explicitly" and "assume breach" in action.

Defense-in-depth

Defense-in-depth is a different shape of idea: a series of concentric layers, with the data you're protecting at the center, each layer slowing an attacker down and generating an alert if breached — so no single point of failure exposes everything.

Layer (outer → inner)Job
Physical securityControls access to the datacenter hardware itself
Identity & accessSSO, MFA, audited sign-ins and changes
PerimeterDDoS protection, perimeter firewalls
NetworkSegmentation, deny-by-default, restricted inbound/outbound
ComputeSecured VM access, endpoint protection, patching
ApplicationSecure-by-default code, secrets in Azure Key Vault
DataEncryption at rest and in transit — the innermost, ultimate target

⚠ Confusable pair: Zero Trust vs. defense-in-depth

Zero Trust is a mindset for access decisions — verify every request explicitly, regardless of where it comes from. It's about trust, evaluated continuously.

Defense-in-depth is a structure for the environment — nested layers around the data, so a breach at one layer doesn't mean total loss. It's about redundancy, arranged in depth.

They're complementary, not competing: Zero Trust governs who gets through each layer; defense-in-depth is the set of layers itself.

Microsoft Defender for Cloud

Microsoft Defender for Cloud is a security posture management and threat protection service — natively integrated into Azure, and extendable to hybrid and multicloud (AWS, GCP) resources via Azure Arc. It's the tool that puts Zero Trust and defense-in-depth into practice day to day, across three pillars:

PillarDoes
Continuously assessVulnerability assessment across VMs, containers, SQL — visibility into your current posture
SecureRecommendations against the Microsoft cloud security benchmark, rolled into a secure score so you can prioritize fixes
DefendGenerates security alerts, correlates related alerts via kill-chain analysis, and provides advanced threat protection (e.g. just-in-time VM access)

Calibration answer: statement 1 (every sign-in evaluated on its own risk, network location irrelevant) is Zero Trust. Statement 2 (an attacker past the firewall still has to fight through segmentation, compute, application, and encryption) is defense-in-depth — specifically the perimeter → network → compute → application → data chain of layers.

Practice

If Zero Trust and defense-in-depth still feel like the same idea restated twice, that's the one thing worth another pass before Lesson 11's checkpoint — everything else in this lesson hangs off that distinction.
← Lesson 9: Identity & Access Lesson 11: Retrieval Practice →