Core Security Concepts

Core security concepts are the foundational principles that guide the design, implementation, and evaluation of all security controls. They exist because information systems face constant threats — unauthorized access, data tampering, service disruption, and theft. Without a shared vocabulary and framework, security discussions become ambiguous and controls become inconsistent. The SC-900 exam expects you to understand these concepts as they apply to Microsoft 365, Azure, and other Microsoft cloud services.

The CIA triad is the most fundamental model in information security. Every security control you encounter — firewalls, encryption, access control lists, backups — maps to one or more of these three principles.

Confidentiality ensures that data is accessible only to authorized subjects. This is achieved through encryption (at rest, in transit, and in use), access control mechanisms (RBAC, ACLs), and data classification. In Microsoft 365, Confidentiality is enforced by Azure Information Protection (AIP) labels that encrypt emails and documents, and by Microsoft Purview Information Protection that applies sensitivity labels. The exam often tests that encryption protects confidentiality, not integrity or availability.

Integrity ensures that data has not been altered or destroyed in an unauthorized manner. Integrity controls include hashing (SHA-256, SHA-512), digital signatures, checksums, and versioning. In Azure, integrity is maintained through immutable storage (Blob storage with legal hold or time-based retention policies) and Azure SQL Database's built-in data integrity features. The exam expects you to know that hashing detects tampering, but does not provide confidentiality.

Availability ensures that data and services are accessible when needed. Availability is achieved through redundancy (RAID, geo-replication), failover clusters, backup and restore, and DDoS protection. In Microsoft 365, availability is guaranteed by the Service Level Agreement (SLA) — typically 99.9% uptime for core services. Azure Availability Zones and Availability Sets ensure that if one datacenter fails, another takes over. The exam may ask which principle is compromised when a DDoS attack takes down a website — that is Availability.

AAA is a model for controlling access to resources. It is closely related to the CIA triad but focuses on the process of granting access.

Authentication verifies the identity of a subject (user, device, service). Factors include:

Microsoft Entra ID (formerly Azure AD) supports password-based, certificate-based, FIDO2, Windows Hello for Business, and Microsoft Authenticator for authentication. Multi-factor authentication (MFA) requires at least two factors. The exam tests that MFA uses two or more factors, not just two passwords.

Authorization determines what an authenticated subject is allowed to do. This is enforced through Role-Based Access Control (RBAC) in Azure and Microsoft 365. RBAC assigns roles (e.g., Global Administrator, User Administrator) that grant specific permissions. The principle of least privilege dictates that subjects should have only the permissions necessary to perform their job. In Azure, you can create custom roles with specific actions (e.g., Microsoft.Compute/virtualMachines/start/action). The exam expects you to know that authorization always follows authentication — you cannot authorize an unauthenticated user.

Accounting (also called Auditing) tracks what subjects did after authentication and authorization. Logs from Azure Monitor, Microsoft 365 audit logs, and Microsoft Purview Audit capture who accessed what, when, from where, and what actions they performed. Accounting enables non-repudiation and forensic analysis. The exam may ask which component of AAA provides evidence of user actions — that is Accounting.

Least Privilege means granting the minimum permissions needed to perform a task. This reduces the blast radius of a compromised account. In Azure, you can implement least privilege by assigning built-in roles with least permissions (e.g., Reader instead of Contributor) and by using Privileged Identity Management (PIM) to grant just-in-time (JIT) access. The exam tests that PIM reduces standing access.

Zero Trust is a security model that assumes breach and verifies each access request as though it originates from an untrusted network. Three core principles:

Microsoft implements Zero Trust through Microsoft Entra ID Conditional Access, Microsoft Defender for Cloud, and Microsoft Sentinel. The exam expects you to recognize that Zero Trust is not a product but a framework, and that it includes micro-segmentation and continuous verification.

Defense in depth is a layered security approach where multiple controls protect the same asset. If one layer fails, another still provides protection. Layers include:

In Azure, defense in depth is implemented by combining Azure Firewall, Network Security Groups (NSGs), Azure DDoS Protection, Microsoft Defender for Cloud, and Azure Information Protection. The exam may ask which layer a specific control belongs to — for example, a firewall is a network security control.

In the cloud, security is a shared responsibility between the cloud provider and the customer. The division of responsibility depends on the service model: - On-premises: Customer handles all security. - IaaS (Infrastructure as a Service, e.g., Azure VMs): Customer secures the OS, applications, and data; Microsoft secures the physical host, network, and datacenter. - PaaS (Platform as a Service, e.g., Azure SQL Database): Customer secures data and access; Microsoft secures the platform. - SaaS (Software as a Service, e.g., Microsoft 365): Customer secures data and user identities; Microsoft secures the application and infrastructure.

The exam often presents scenarios where you must identify who is responsible for a specific control. For example, patching the guest OS in an IaaS VM is the customer's responsibility; patching the hypervisor is Microsoft's responsibility.

Core concepts are not isolated; they are implemented through specific Microsoft technologies. For example:

The exam will test your ability to map a scenario to the correct principle or technology. For example, if a question describes a company that wants to ensure that only authorized users can read financial reports, the principle is Confidentiality, and the technology could be Azure Information Protection with a sensitivity label that restricts read access.

A large bank wants to move its trading applications to Azure while ensuring that only authorized employees can access sensitive financial data. They implement Microsoft Entra ID with Conditional Access policies that require MFA and device compliance (Intune managed) for any access to the trading app. They use PIM to grant administrators just-in-time access to the Azure subscription, with approval from a manager and a maximum activation time of 4 hours. They also deploy Azure Information Protection to label and encrypt all financial reports with the 'Highly Confidential' label, which prevents forwarding and printing. The bank achieves defense in depth: Confidentiality via AIP, Authentication via MFA, Authorization via RBAC and PIM, and Accounting via Azure Monitor. A common pitfall is forgetting to configure Conditional Access for non-corporate devices — without it, employees could access the app from personal devices without MFA, violating Zero Trust.

A hospital uses Azure SQL Database to store patient records. They must ensure that medical records cannot be altered without detection (integrity). They enable Azure SQL Database's built-in temporal tables to track historical changes, and they use immutable storage for backup files with a time-based retention policy of 7 years (regulatory requirement). They also configure audit logging to capture all data modifications. The hospital's security team regularly reviews logs using Azure Sentinel to detect unauthorized changes. A common mistake is relying solely on backups for integrity — backups protect availability, not integrity, because a tampered record would be backed up as well. They also learn that hashing the records and storing the hash separately provides integrity, but they must ensure the hash storage is also secured.

An online retailer runs its website on Azure VMs. They configure an Availability Set with two VMs in different update domains and fault domains to ensure that planned maintenance or a hardware failure does not take down the site. They also enable Azure DDoS Protection Standard to mitigate volumetric attacks. They set up Azure Traffic Manager to distribute traffic across multiple regions. Despite these measures, a misconfigured Network Security Group (NSG) that blocks all inbound traffic except from a specific IP range causes an availability outage when the office IP changes. This highlights that availability controls must be tested regularly. The exam may ask which combination of services ensures high availability — the answer is often Availability Sets plus Azure Load Balancer or Traffic Manager.