Path 6 · Module 3
Well-Architected Framework: Security
Read the module on Microsoft Learn, then come back here: test yourself with the quiz and apply it in the design exercise. Write down what you want to remember with the ✎ Note buttons.
Step 1 · Read the module
Open Well-Architected Framework: Security on Microsoft Learn. The units:
- Introduction
- Plan your security readiness
- Design to protect confidentiality
- Design to protect integrity
- Design to protect availability
- Sustain and evolve your security posture
- Summary
Close the Learn tab. Answering from memory is what makes it stick; looking it up just measures how fast you can scroll.
Quiz
20 exam-style questions, roughly in the order of the units. Click an answer to see the explanation. Your best score is saved and shown on the path page; use Retry at the end to go again.
1. What do the letters CIA stand for in the security pillar?
A. The CIA triad is the backbone of the security principles.
2. Which are the three principles of Zero Trust?
C. Zero Trust doesn't trust anything by default.
3. What should security readiness start with?
B. Readiness includes a plan, roles (RACI), and a baseline that matches the business.
4. Who is responsible for data and identities in the cloud shared responsibility model?
A. Regardless of service model, you own your data, identities and accounts.
5. What's data classification for?
B. Protection should match sensitivity (e.g. with Microsoft Purview labels).
6. Which practice best protects confidentiality of secrets used by an app?
D. Centralized secret management with no credentials in code.
7. Data must be encrypted at rest with keys the company controls. What do you design?
D. CMK gives control over rotation and revocation.
8. Which control protects integrity of deployed code?
B. Integrity means detecting and preventing unauthorized changes, including in the build pipeline.
9. How does immutable infrastructure help integrity?
D. Rebuild rather than patch by hand.
10. Which network design limits an attacker's lateral movement?
C. Segmentation contains a breach.
11. Which service protects public endpoints against volumetric attacks?
B. DDoS protection preserves availability during attacks.
12. Which service protects web apps against SQL injection and cross-site scripting at the edge?
A. WAF filters layer-7 attacks like the OWASP top 10.
13. Why are rate limiting and throttling part of the availability principle?
B. Availability includes protecting against resource exhaustion.
14. Which tool gives a secure score and recommendations across Azure, multicloud and hybrid resources?
A. Defender for Cloud provides CSPM and workload protection.
15. Which service is the SIEM/SOAR for collecting security signals and automating responses?
A. Sentinel correlates incidents and automates response with playbooks.
16. Why should you have a tested incident response plan?
D. Preparation shortens time to contain and recover.
17. What does threat modeling do?
A. Threat modeling is done during design and revisited when the design changes.
18. Why should privileged access be just-in-time?
B. Just-in-time and just-enough access reduce the attack surface.
19. How do you keep the security posture current over time?
B. Threats evolve; security must evolve with them.
20. Which is an example of defense in depth?
D. Multiple layers mean one failure doesn't expose everything.
Design exercise
On paper · about 25 minutes
Ashford Payroll is a SaaS payroll provider on Azure: App Service front end, Functions for payroll runs, Azure SQL with salary data, and Blob Storage with payslip PDFs. Developers deploy from laptops; several have Owner on production.
-
Task
Apply the CIA triad
Write two controls each for confidentiality, integrity and availability.
Done when- Six controls, two per letter.
Model answer
- C: Always Encrypted/TDE with CMK on salary data; private endpoints + Entra auth for storage.
- I: CI/CD with signed artifacts and branch protection; immutable payslip storage.
- A: Front Door WAF + DDoS protection; rate limiting in APIM.
-
Task
Fix access and operations
How do you deal with developer Owner rights and laptop deployments, and how do you detect incidents?
Done when- No standing Owner access.
- Deployments are automated.
- Detection and response are covered.
Model answer
Remove standing Owner; PIM just-in-time elevation with approval; deployments only via pipeline with workload identity federation; Defender for Cloud plans; Sentinel with playbooks; incident response runbook tested twice a year; threat model per release.