Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

6.2. Keyword Mapping and Distractor Identification

💡 First Principle: Exam questions contain keywords that signal specific answers. Think of it like a treasure map—certain phrases are X marks that point directly to the correct answer. Learning to recognize these patterns accelerates your response time and improves accuracy. You'll know what the question is really asking before you finish reading it.

Without this skill, what happens? You waste precious minutes re-reading questions, second-guessing yourself, and falling for traps that exploit common misconceptions. Candidates who master keyword recognition typically finish with 15-20 minutes to spare for review—those who don't often run out of time.

Consider this scenario: a question mentions "time-limited access to a single table in Azure Storage." The phrase "time-limited" signals SAS tokens, and "single table" signals Service SAS (not Account SAS). Two keywords, one definitive answer. The distractor will likely be Account SAS or storage firewall rules—both plausible but incorrect for this specific combination.

Distractor options are intentionally plausible. They represent common misconceptions (confusing Application Administrator with Cloud Application Administrator), similar-sounding services (Private Link vs. Private Endpoint), or partial solutions (WAF without DDoS Protection). Training yourself to recognize these traps is as valuable as memorizing correct answers—perhaps more so, because the exam writers specifically design questions to exploit these confusion points.

If you see this keyword...Look for this answer...Common Distractor
"Without additional cost" + MFAAuthenticator, SMS, Voice callFIDO2 keys, OATH hardware tokens
"Cannot restart VM" + custom roleMissing read permissionMissing login permission
"Assign users to enterprise apps"Cloud Application AdministratorApplication Administrator
"Resource Policy Contributor"Create/modify policiesCompliance Administrator (Entra role)
"Certificate credentials" for appSecure, not transmittedClient secrets
"Multitenant, Azure only"AzureADMultipleOrgsAzureADandPersonalMicrosoftAccount
"Restrict app registration""Users can register" = No + Application DeveloperCloud App Admin to all users
"10-100 Gbps encrypted"ExpressRoute Direct with MACSecVPN Gateway, standard ExpressRoute
"Azure Cosmos DB firewall"Add web app outbound IPs + Allow Azure PortalAdd user IP to firewall
"Route through firewall"User-defined routes to firewall private IPVPN Gateway
"Private Link service"Provider side (offer service)Private Endpoint (consumer side)
"Service endpoints - count"One per subnetOne per VNet
"App Service in VNet subnet"Isolated tier (ASE)Standard tier
"Gateway required integration"Different regionsSame region
"SSL offload at edge"Azure Front DoorApplication Gateway
"Web vulnerabilities"WAFDDoS Protection
"DDoS attacks"DDoS Protection StandardWAF
"Firewall rule priority"100-65000 (100 highest)Priority 0
"az acr login"Authenticate to ACRaz acr config
"Time-limited storage access"SAS with expiryShared key
"Single table access"Service SASAccount SAS
"IP restriction per file (many files)"Service SAS with signedIPStorage firewall
"Revoke compromised SAS"Regenerate storage account keysDisable public access
"Public blob access - least privilege"Blob level (not Container)Container level
"Always Encrypted - supports"Encrypting existing dataCopying between columns
"Duplicate audit entries"Disable database-level auditingDisable server auditing
"DBAs cannot see data"Always EncryptedTDE
"Mask credit card (verify last 4)"partial(0,"XXXX-XXXX-XXXX-",4)default()
"UNMASK permission"See original masked dataSee all data
"Tag policy - deny creation"effect: denyeffect: append
"Tag inheritance - skip RGs"indexed modeall mode
"Key Vault - read/write keys"Key Vault Crypto OfficerKey Vault Secrets Officer
"Soft delete + purge protection"Cannot permanently deleteHSM-protected vault
"GDPR compliance"Custom standard requiredBuilt-in initiative
"AWS, GCP, GitHub, Azure DevOps"Defender for Cloud supportedAlibaba Cloud, Oracle Cloud
"Permissions creep"CIEM / Permissions ManagementPIM (for Azure-only)
"Agentless Scanning (2026)"Snapshot-based assessment (No agents)MDE/Qualys agents only
"Snapshot-based methodology"VM disk -> Snapshot -> Secure EngineRuntime behavioral analysis
"Azure Functions agentless"Dependency/File scanning (PaaS)Code-level SDKs only
"Multi-cloud Agentless"Azure, AWS (EC2), GCP (Compute)Azure-only scanning
"Unused role assignments (2026)"CIEM detection methodSign-in activity only
"90-day CIEM lookback"Extended detection window30-day window
"Code-to-cloud visibility"Defender for DevOpsDefender for Servers
"IaC Scanning (Terraform/Bicep)"DevOps security findingsAzure Policy only
"SBOM (Software Bill of Materials)"Supply chain securityManaged Identity
"Prompt injection"Content filtering & safety settingsNSGs/Firewalls only
"AI agent discovery"Microsoft Copilot StudioAzure AI Foundry
"Generative AI - Private access"Private Endpoints for Azure OpenAIService Endpoints
"AI Attack surface discovery"Defender for Cloud AI SecurityMicrosoft Sentinel connectors
"External attack surface"Defender EASMDefender for Cloud policies
"SQL vulnerability scan frequency"Once per week (fixed)Configurable
"SQL scan results location"Azure Storage accountLog Analytics only
"Azure Functions connector"Read/write Functions permissionWorkspace permissions
"Alert per VM in resource group"Single rule + split by dimensionIndividual rules per VM
"Send logs to external SIEM"Event HubsAzure Storage
"Standardized Account Entities"Logic for cross-entity correlationStatic mapping only
"Sentinel MCP Server"AI Context Protocol for SecOpsStandard data connector
"Integrated Data Lake"ADX for long-term retentionLog Analytics only
"Analytics vs. Basic vs. Archive"Cost optimization tiersHot vs. Cold storage only
"UEBA (Anomalous Behavior)"Baseline profiling & Risk scoringSignature-based detection
"SOAR Playbooks"Logic Apps for automated responseAzure Automation accounts
"Impossible Travel"UEBA detection patternStatic IP blocklist
"Proactive Hunting"Using KQL to find IoCsWaiting for analytics alerts
"Incident Enrichment"Automated VirusTotal/Whois lookupManual investigation
"Cross-Entity Correlation"Unified incident groupingSingle alert management
Alvin Varughese
Written byAlvin Varughese
Founder•15 professional certifications