CCNA Describe The Concepts Of Security Compliance And Identity Questions

The shared responsibility model correctly defines the split of security tasks between the cloud provider and the customer based on the service model (IaaS, PaaS, SaaS). In this SaaS example, the provider handles infrastructure, and the customer handles data and access.

Conditional Access evaluates signals such as device compliance state from Microsoft Intune and enforces grant controls, so only compliant, encrypted, patched devices reach Exchange Online. This satisfies the requirement to block non-compliant devices from corporate email at authentication time.

Employee IDs follow the fixed pattern EMP- followed by five digits, so a regular expression defines that structure precisely. Rule pack elements such as keywords or dictionaries cannot match positional digit patterns; the regex element supplies the pattern-matching logic Microsoft Purview requires for this custom sensitive information type.

Digital signatures achieve non-repudiation by cryptographically binding a sender's identity to a message. The sender uses their unique private key to sign a hash of the document, creating a verifiable digital fingerprint. This signature, which can be validated by anyone with the sender's corresponding public key, provides irrefutable proof of origin and consent, ensuring the sender cannot legitimately deny having sent the message or performed the action.

A sensitivity label, once created and configured, must be explicitly published through a label policy to become active and available for users or automatic application. Without being included in a policy and assigned to specific users or groups, the label remains in a draft state and cannot be applied, either manually or automatically, to documents or emails. This publishing step is critical for the label's operational deployment and is the most common reason for a configured label not being applied.

The 'Verify explicitly' principle is a cornerstone of the Zero Trust model, mandating that every access request to any resource must be fully authenticated, authorized, and validated based on all available contextual signals. This includes user identity, device health, location, service, and data classification, ensuring no implicit trust is ever granted. It requires continuous, real-time evaluation before granting access, regardless of whether the request originates inside or outside the traditional network perimeter.

Zero Trust is the security model that fundamentally assumes no user, device, or application should be automatically trusted, regardless of its location inside or outside the network perimeter. It mandates explicit verification for every access request, ensuring identity and device health are validated before granting access. This model strictly enforces least privilege access and operates under an 'assume breach' mentality, continuously monitoring and re-validating trust throughout a session.

Conditional Access policies evaluate various signals, including user location, device compliance, and sign-in risk, to determine if access should be granted or blocked. A policy configured to restrict access to sensitive documents from untrusted or unapproved geographic locations would explicitly override any inherent sensitivity label permissions, directly causing the user's inability to access the document.

Authorization is the critical security process that determines what an authenticated user is permitted to do or access within a system. After a user successfully authenticates with a smart card, the system consults predefined policies, roles, and permissions to evaluate whether that user has the necessary rights to perform a specific action, such as accessing a particular database. This evaluation directly leads to the decision of whether access is granted or denied.

Conditional Access evaluates signals such as user, device compliance and location, then enforces grant controls before access is allowed. This satisfies the Zero Trust requirement to verify that users and devices meet specific health requirements before granting access to corporate resources.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It excels at collecting security data from diverse sources across an organization's entire digital estate, including Azure, on-premises, and other clouds, through built-in data connectors. Sentinel then uses AI and machine learning to detect, investigate, and respond to threats efficiently, making it ideal for comprehensive security event collection and analysis.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information across various locations, including email. They utilize sensitive information types (SITs) to detect specific data patterns, such as credit card numbers, and can enforce actions like blocking email transmission, notifying users, or encrypting content to prevent unauthorized sharing. This capability directly addresses the requirement to detect sensitive data and block its sharing via email.

Single sign-on (SSO) to cloud applications is a core benefit of Microsoft Entra ID, enabling users to authenticate once with their Entra ID credentials and gain seamless access to thousands of integrated Software-as-a-Service (SaaS) applications. This capability significantly enhances user productivity by eliminating the need to remember multiple passwords and repeatedly log in, while also improving security by centralizing identity management. Entra ID acts as the central identity provider, issuing secure tokens after initial authentication.

Microsoft Purview is the unified data governance service spanning multi-cloud and on-premises sources, satisfying the stem's cross-estate constraint. Its Data Map catalogues and classifies assets, while sensitivity labels and policies enforce protection, capabilities that Microsoft Entra ID and Defender for Cloud do not provide.

Assigning minimum permissions is a core implementation of least privilege. It ensures users can only access resources essential for their roles, reducing the potential impact of compromised accounts. In a Zero Trust model, this limits lateral movement and enforces strict access control. This practice directly supports the principle of least privilege and is a recommended security control.

The Shared Responsibility Model is a fundamental framework in cloud computing that explicitly delineates security obligations between the cloud service provider (CSP) and the customer. The CSP is responsible for the security *of* the cloud, encompassing the underlying infrastructure, physical facilities, and host operating systems. Conversely, the customer is accountable for security *in* the cloud, which includes their data, applications, network configurations, and identity and access management. This model ensures clarity on who manages what aspects of security, varying based on the service model adopted.

Registering the SaaS application as an enterprise application in Microsoft Entra ID creates the service principal and trust configuration needed for SAML or OIDC federation. This enables single sign-on and lets you assign users and configure claims for the third-party service.

Zero Trust is a strategic security model predicated on the principle of "never trust, always verify." It fundamentally assumes that a breach is inevitable or has already occurred, requiring explicit verification for every access request, regardless of origin or prior authorization. This model mandates continuous validation of identity, device health, and service context, while enforcing least privilege access to minimize potential damage from successful intrusions.

DLP policies in Microsoft Purview detect sensitive information types and sensitivity labels, then automatically block sharing, restrict access, or warn users. This enforces HIPAA protection without manual review, satisfying the requirement to apply safeguards automatically across workloads.

Role inclusion in a conditional access policy targets the directory role assignment, so every user holding Global Administrator or Exchange Administrator membership is in scope. The policy evaluates role membership, not sign-in location or client app, so all such members are affected.

Digital signatures let the recipient verify that a record's contents have not been altered in transit, because any modification invalidates the signature check against the signer's key. This directly satisfies the requirement to detect tampering, which is the integrity goal rather than confidentiality or availability.

Least privilege grants users only the access required for their tasks, limiting lateral movement if credentials are compromised. This directly implements Zero Trust's assume-breach principle by constraining each identity's permissions rather than trusting network location.

Infrastructure as a Service (IaaS) is the correct choice for migrating existing on-premises workloads to Azure because it provides the most control over the underlying operating systems, applications, and data, closely mirroring an on-premises environment. In IaaS, the customer is responsible for securing the operating system, applications, network configuration, and data, while Azure manages the physical infrastructure, virtualization, and networking fabric. This model facilitates a "lift-and-shift" approach, allowing the CISO to maintain significant security responsibility and control over their familiar stack within the cloud.

The cmdlet applies a sensitivity label to the specified document, tagging it with the organisation's classification so encryption and protection policies follow the file. It does not create, remove or list labels, only assigns one.

Verify explicitly requires authentication and authorisation decisions using all available signals, including identity, device health and location. It satisfies the Zero Trust principle that every access request is fully authenticated before resource access is granted.

Confidentiality, a cornerstone of the CIA triad, ensures that information is accessible only to those authorized to view it. This principle directly addresses the company's security measure to limit access to specific employees, preventing unauthorized disclosure of sensitive data. Implementing strong access controls, encryption, and data classification are typical methods to uphold confidentiality, aligning perfectly with the goal of restricting information access.

Confidentiality is the fundamental security principle that ensures information is not disclosed to unauthorized individuals, entities, or processes. It directly addresses the requirement of limiting access to customer data only to those who are explicitly authorized, typically through mechanisms like encryption, access control lists (ACLs), and the principle of least privilege. This principle is paramount for protecting sensitive information from unauthorized viewing or exposure, aligning perfectly with the stated security policy.

Integrity ensures data has not been tampered with or corrupted during transit or storage. When a user downloads a software update, comparing its cryptographic hash (e.g., SHA256) with a known, trusted hash value provided by the company directly verifies that the file's contents are exactly as intended. This process specifically confirms the data's integrity, ensuring the downloaded software is free from unauthorized modifications or accidental damage.

Managing user access and classifying data stored within the SaaS application are critical customer responsibilities. The customer defines who can access their organizational data, what permissions they have, and how sensitive that data is, directly impacting data governance and compliance. This ensures that customer-specific information remains secure and properly handled according to internal policies and regulatory mandates.

Encryption is a primary control for ensuring confidentiality by transforming data into an unreadable format, known as ciphertext. This process prevents unauthorized individuals from accessing or understanding the sensitive patient records, even if they manage to intercept or steal the encrypted data. Only authorized parties possessing the correct decryption key can revert the data to its original, readable form, thereby protecting against unauthorized disclosure.

Deploying a mission-critical customer portal across multiple Azure regions with automatic failover directly addresses the 'A' in the CIA triad: Availability. This strategy ensures that the portal remains continuously accessible and operational for authorized users, even if an entire geographic region experiences a catastrophic outage. The primary objective is to minimize downtime and provide uninterrupted service, which is paramount for mission-critical systems.

Zero Trust is a security model fundamentally built on the principle of 'never trust, always verify,' meaning no user, device, or application is implicitly trusted, regardless of its location inside or outside the network perimeter. Every access request is explicitly authenticated, authorized, and continuously validated based on all available data points, including user identity, device health, service, and data classification. This continuous verification ensures that access is granted only when all conditions are met, eliminating implicit trust.

As part of the Platform as a Service (PaaS) offering, Microsoft is fully responsible for managing and patching the underlying operating system and virtual machine infrastructure that hosts Azure App Service instances. This includes applying security updates, hotfixes, and service packs to the host OS to maintain platform security and stability, abstracting this operational burden from the customer. This responsibility ensures the foundational environment upon which customer applications run remains secure.

Microsoft Entra Conditional Access evaluates signals including user identity, device compliance, location and sign-in risk, then enforces grant or block decisions per policy. This directly implements the explicit verification and least privilege requirements of the Zero Trust model described.

Authentication is the foundational security process of verifying an entity's identity, confirming they are who they claim to be. In this scenario, requiring a one-time passcode (OTP) alongside another factor, like a password, establishes multi-factor authentication (MFA). This robust method significantly enhances security by requiring multiple proofs of identity before granting access to a system or resource, directly addressing the company's need to confirm employee identity.

This option accurately describes the combined effect of a typical DLP policy configured for strict enforcement. When sensitive information is detected within the email, the policy's 'Block access' action prevents the email from being delivered to its intended recipients, ensuring data protection. Concurrently, the policy's notification setting ensures that the sender is immediately informed about the policy violation and the reason for the email's blocking, allowing them to understand and rectify the issue.

Accountability is the ability to trace actions and events back to a specific entity, whether a user, process, or system. By meticulously recording access, modifications, and system events, logging creates an indispensable audit trail. This trail enables forensic analysis, compliance verification, and the attribution of responsibility, making it a foundational component for holding individuals and systems accountable for their actions within an organization.

Integrity ensures that data remains unaltered and complete during transmission or storage. When a user verifies that the content of an encrypted email from their bank has not been changed, they are confirming its integrity. This is typically achieved through cryptographic mechanisms like hashing or digital signatures, which detect any unauthorized modification, ensuring the message received is exactly what was sent.

When a user enters credentials to access a financial application, the system performs authentication. This crucial initial step verifies the user's claimed identity by comparing the provided username and password against stored records. Successful authentication confirms 'who' the user is, granting them entry to the system.

Authorization is the process of granting or denying access to resources based on the authenticated user's permissions. The role check determines if the user is authorized to access the user management page, making this the correct answer.

Cloud Discovery analyses traffic logs from firewalls and proxies to identify unsanctioned cloud apps, directly satisfying the shadow IT discovery requirement. It builds an app catalogue with risk scores, letting you sanction or block usage. Other Defender for Cloud Apps features, such as app connectors or anomaly policies, govern known apps rather than reveal unknown ones.

Microsoft Purview DLP inspects Exchange Online mail flow, applying sensitive information type regex and checksum validation to detect credit card numbers, then enforcing policy tips, block or encrypt actions. This satisfies the stem's capability requirement for email-borne payment card data.

Explicit verification authenticates and authorises every access request using all available signals, regardless of network origin. This directly satisfies the zero-trust requirement to treat internal requests as untrusted, rather than granting implicit trust based on corporate network location.

Non-repudiation is the assurance that a party cannot legitimately deny having performed a specific action or sent a particular message. In the context of financial stock trades, a digital signature cryptographically binds the unique identity of the trader (via their private key) to the specific trade instruction. This creates undeniable, legally admissible proof that the trader authorized and executed that particular transaction, preventing them from later disavowing their actions.

Defense in depth is a comprehensive cybersecurity strategy that employs multiple, overlapping security controls to protect assets and data. By deploying a firewall, the company is establishing a perimeter defense, which constitutes one critical layer in a multi-layered security architecture. This approach ensures that if one security control fails or is bypassed, other controls are already in place to prevent or detect an intrusion, significantly enhancing overall resilience against various threats.

Data integrity ensures that information remains accurate, complete, and unaltered throughout its lifecycle, protecting against unauthorized modification or destruction. In this scenario, an attacker directly modified patient diagnoses, which fundamentally compromises the trustworthiness and reliability of the medical records. This unauthorized alteration is a clear violation of the integrity principle, as the data no longer reflects its original, correct state.

Compliance management is the overarching discipline that ensures an organization adheres to external laws, regulations, and internal policies, such as HIPAA. It involves establishing frameworks, implementing controls, conducting risk assessments, monitoring adherence, and maintaining documentation to systematically meet all regulatory requirements and demonstrate due diligence to auditors and regulators.

Just-in-time (JIT) access grants temporary, time-limited elevated permissions to users or systems only when explicitly requested and strictly for the duration required to complete a specific task. This approach minimizes the window of opportunity for misuse or compromise by ensuring that administrative privileges are not persistently held. The scenario directly describes this mechanism of on-demand, temporary access for server administration.

Role groups in Purview grant access to the compliance portal.

Encrypting data during transmission directly ensures that only authorized entities with the correct decryption key can access or read the information. This process transforms plaintext into ciphertext, making it unintelligible to any unauthorized interceptors who might intercept the data in transit. Therefore, the primary objective of such a security policy requirement is to prevent unauthorized disclosure of sensitive data while it traverses networks, directly upholding confidentiality.

Defense in depth is a comprehensive security strategy that layers multiple, independent security controls to protect assets across various domains. This approach ensures that if one security control fails or is bypassed, other controls are still in place to detect, prevent, or mitigate an attack, significantly increasing resilience against diverse threat vectors. It encompasses physical, technical, and administrative safeguards, creating a robust and redundant barrier.

Anomaly detection policies in Microsoft Defender for Cloud Apps baseline normal user behaviour and alert on deviations such as mass file downloads. The 100-files-in-10-minutes threshold is a behavioural anomaly, not a signature or access rule, so this policy type satisfies the detection requirement.

Defense in depth fundamentally involves deploying a comprehensive array of security controls across various layers and domains within an IT environment. This layered strategy ensures that if one security control is compromised or bypassed, other independent controls are still in place to detect, prevent, or mitigate the attack. It encompasses physical, technical, and administrative safeguards, creating a resilient security posture that significantly increases the effort and resources required for an attacker to succeed.

Integrity ensures that data has not been tampered with or altered from its original state. Digital signatures achieve this by creating a unique cryptographic hash of the document, which is then encrypted with the sender's private key. Any subsequent modification to the document would result in a different hash value, immediately revealing that the data's integrity has been compromised upon verification.

Sensitivity labels auto-classify and protect personal data across SharePoint and OneDrive, while retention labels keep specified records for the mandated seven years. Together they satisfy both the GDPR protection requirement and the minimum retention period within Microsoft Purview.

Records Management in Microsoft Purview is specifically designed to help organizations meet their legal, regulatory, and business obligations for retaining and disposing of information. It enables the declaration of content as a record, applying immutable retention labels and policies to automatically retain items for a specified period or delete them defensibly when no longer required. This ensures that critical business information is preserved and disposed of according to a defined lifecycle, preventing accidental deletion and supporting compliance audits.

Entitlement Management is a robust capability within Microsoft Entra ID Governance that enables organizations to manage identity and access lifecycle at scale through access packages. It allows for automatic access removal based on various lifecycle events, such as a user's employment status change or removal from a connected organization. This makes it ideal for ensuring access to groups, applications, and SharePoint sites is revoked promptly and automatically when no longer needed, aligning perfectly with the need for automated access removal.

In the Shared Responsibility Model for Infrastructure as a Service (IaaS), Microsoft is solely responsible for the physical security of the underlying data centers. This encompasses safeguarding the physical infrastructure, implementing robust access controls, deploying surveillance systems, and managing environmental factors like power, cooling, and fire suppression. Customers are relieved of these foundational infrastructure concerns, allowing them to focus on their virtualized workloads.

Full disk encryption (FDE) directly addresses confidentiality by rendering all data on a laptop unreadable to unauthorized individuals. If the device is lost or stolen, the encrypted data remains protected, preventing its disclosure without the correct decryption key. This ensures that only authorized users or processes can access and interpret the sensitive information stored on the drive.

Managing access controls and authentication for database users stays with the customer under the shared responsibility model. Microsoft secures the underlying Azure infrastructure, but identity management for Azure SQL Database remains yours. Configuring Microsoft Entra ID authentication and database-level permissions satisfies the stem's requirement for customer-retained security tasks.