Skip to main content

Challenge 18: Security — Zero Trust, Defense-in-Depth & Defender

Estimated Time

20-30 min | Cost: Free | Domain: Azure Architecture & Services (35-40%)

Exam skills covered​

  • Describe the concept of Zero Trust
  • Describe the purpose of the defense-in-depth model
  • Describe the purpose of Microsoft Defender for Cloud

Overview​

Security in Azure is built on fundamental concepts: Zero Trust (never trust, always verify), defense-in-depth (multiple layers of security), and Microsoft Defender for Cloud (unified security management). These concepts work together to protect your cloud resources.

Explore​

Task 1: Understand Zero Trust​

Zero Trust operates on three principles:

PrincipleDescriptionExample
Verify explicitlyAlways authenticate and authorize based on all available dataCheck user identity, location, device health
Least privilege accessGive minimum permissions neededUse just-in-time and just-enough-access
Assume breachMinimize blast radius and verify end-to-endSegment access, use encryption, verify everything

Traditional security: "Trust everything inside the network" Zero Trust: "Trust nothing, verify everything"

Task 2: Understand defense-in-depth​

Defense-in-depth uses multiple layers of security. If one layer fails, the next layer catches the threat:

Layer 1: Physical Security    → Datacenter access controls
Layer 2: Identity & Access    → Entra ID, MFA, Conditional Access
Layer 3: Perimeter           → DDoS protection, firewalls
Layer 4: Network             → NSGs, VNets, segmentation
Layer 5: Compute             → VM security, patching, endpoint protection
Layer 6: Application         → Secure coding, vulnerability scanning
Layer 7: Data                → Encryption at rest and in transit

Key insight: No single layer provides complete protection. Security requires ALL layers working together.

Task 3: Explore Microsoft Defender for Cloud​

  1. In Azure Portal, search for Microsoft Defender for Cloud
  2. Explore the main sections:
    • Overview: Security posture score
    • Recommendations: Suggested security improvements
    • Security alerts: Detected threats
    • Regulatory compliance: Compliance against standards
  3. Note the Secure Score — a percentage rating of your security posture

Defender for Cloud provides:

  • Continuous security assessment
  • Security recommendations
  • Threat protection with alerts
  • Compliance tracking (PCI-DSS, SOC, ISO 27001)
  • Just-in-time VM access

Task 4: Defender for Cloud capabilities​

FeatureDescriptionCost
Secure ScoreGrade your security posture (0-100%)Free
RecommendationsPrioritized security fixesFree
Enhanced protectionsDefender plans for specific servicesPaid (per-resource)
Regulatory complianceMap controls to compliance standardsFree (basic)

Defender plans (enhanced security for specific services):

  • Defender for Servers
  • Defender for Storage
  • Defender for SQL
  • Defender for Containers
  • Defender for App Service
  • Defender for Key Vault

Task 5: Zero Trust in practice​

How Azure services implement Zero Trust:

Zero Trust controlAzure service
Verify identityEntra ID + MFA
Verify device healthIntune + Conditional Access
Least privilegeRBAC + PIM (Privileged Identity Management)
Micro-segmentationNSGs + VNets + Private endpoints
EncryptionAzure Key Vault + TLS + disk encryption
Monitor and respondDefender for Cloud + Sentinel
Azure CLI Alternative
# Check Defender for Cloud secure score
az security secure-score list --output table 2>/dev/null || echo "Explore Defender for Cloud in the portal"

# List security recommendations
az security assessment list --query "[0:5].{Name:displayName, Status:status.code}" --output table 2>/dev/null || echo "View recommendations in the portal"

Key Concepts​

ConceptDescription
Zero TrustNever trust, always verify — regardless of network location
Defense-in-depthMultiple layers of security protecting resources
Microsoft Defender for CloudUnified security management and threat protection
Secure ScorePercentage measure of your security posture
Least privilegeGrant minimum permissions needed for the task
Assume breachDesign security expecting attackers are already inside

Knowledge Check​

1. Which security principle states that you should "never trust, always verify"?

2. In the defense-in-depth model, what happens if one security layer is breached?

3. What does Microsoft Defender for Cloud Secure Score measure?

4. Which defense-in-depth layer includes firewalls and DDoS protection?

5. A Zero Trust principle states that users should only have the minimum permissions needed to do their job. What is this called?

Learn More​