Zero Trust, MCRA and Microsoft frameworks
SC-100 questions rarely ask how to click through a setting. They ask which framework, principle or Microsoft capability is the right starting point. You need to know what each framework is for.
Zero Trust principles
Zero Trust has three principles:
- Verify explicitly: authenticate and authorize using all signals, such as identity, device health, location and risk.
- Use least privilege access: just-in-time and just-enough access, risk-based adaptive policies.
- Assume breach: segment, encrypt, and use analytics to detect and limit blast radius.
Zero Trust is applied across six pillars: identities, endpoints, apps, data, infrastructure and network.
Which framework answers which question
| Framework | Use it for |
|---|---|
| Microsoft Cybersecurity Reference Architectures (MCRA) | Diagrams of Microsoft security capabilities and how they integrate |
| Zero Trust Rapid Modernization Plan (RaMP) | Prioritized actions and quick wins for Zero Trust |
| Microsoft cloud security benchmark (MCSB) | Security controls and baselines for Azure and multicloud |
| Cloud Adoption Framework (CAF) | Strategy, plan, ready, adopt, govern, manage and secure for the cloud journey |
| Azure Well-Architected Framework (WAF) | Workload quality, including the Security pillar |
| Microsoft Security Development Lifecycle (SDL) | Secure software development practices |
CAF is about the organization and its landing zones. WAF is about one workload.
Privileged access strategy
For a privileged identity design based on Zero Trust, follow the privileged access strategy and its rapid modernization plan. It replaces the older Enhanced Security Admin Environment (ESAE) model and the “red forest” idea. The key elements are:
- Separate admin accounts from daily accounts.
- Use Privileged Access Workstations (PAWs) or secure workstations.
- Use Microsoft Entra Privileged Identity Management (PIM) for just-in-time roles.
- Keep emergency access accounts that are excluded from normal Conditional Access and are monitored.
Security priorities
Microsoft guidance orders security work by business risk. A typical order from MCRA and RaMP:
- Protect identities with MFA and Conditional Access.
- Secure endpoints and apps.
- Protect data with classification and labels.
- Segment infrastructure and network.
- Monitor with Defender XDR and Microsoft Sentinel.
Names changed over time. The Microsoft 365 Defender portal is now the Microsoft Defender portal and the product is Defender XDR. Azure Active Directory is Microsoft Entra ID. Older questions may use the old names.
Exam traps
- MCRA is diagrams, the benchmark is controls, RaMP is a prioritized plan. Do not swap them.
- ESAE is the legacy answer. Pick the privileged access strategy or RaMP for Zero Trust.
- Well-Architected is per workload, Cloud Adoption Framework is per organization.
- SDL is for development, not for operations or network design.
- “Verify explicitly” is not the same as “assume breach”. Segmentation and detection map to assume breach.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. You must prioritize the first steps of a Zero Trust rollout, starting with quick wins such as MFA and protecting identities. Which Microsoft guidance fits best?
Show answer
Answer: A.RaMP is the prioritized, checklist-style initiative plan for Zero Trust. ESAE is the old red-forest model that Microsoft has retired.
2. An architect needs a diagram showing how Microsoft security capabilities, such as Defender XDR, Sentinel and Entra, fit together across people, devices, apps and infrastructure. What should they use?
Show answer
Answer: B.MCRA is a set of diagrams that show Microsoft capabilities and how they integrate. The benchmark is a set of controls, not a diagram.
3. Which principle states that you should design as if the network is already compromised?
Show answer
Answer: C.Assume breach means segment access, encrypt end to end and use analytics to detect and limit damage.
4. Which framework contains a Secure methodology that covers security governance, posture and operations for cloud adoption?
Show answer
Answer: B.The Cloud Adoption Framework has a Secure methodology next to Strategy, Plan, Ready and Govern. The Well-Architected Framework covers workload design pillars.