3.4. Reflection Checkpoint

Key Takeaways

• Storage and database security both follow the same two-gate pattern established for Key Vault in Phase 2: network reachability and identity-based access control are independent, and both need to be correct.
• Detection layers (Defender for Storage, Defender for Databases) catch behaviorally suspicious activity that technically passes every preventive check — they complement rather than replace access management.
• Network controls are layered by scope: NSGs/ASGs at the resource level, Virtual Network Manager/Virtual WAN centrally across many VNets, VPN/Private Access at the on-premises-to-cloud boundary, and Private Link/Private Endpoints removing PaaS resources from public reachability entirely.
• Security admin rules can override local NSG configuration by design — central policy is meant to win over local misconfiguration, not just recommend a baseline.
• Network Watcher's effective security rules view resolves ambiguity when multiple layered rule sources make manual troubleshooting unreliable.

Connecting Forward

Phase 4 moves from data-at-rest and network boundaries to the compute and AI workloads running inside them — including the exam's newest content area, AI security, where several Phase 3 patterns (private connectivity, layered filtering) reappear applied to model and agent traffic through the AI Gateway.

Self-Check Questions

• If a storage account, a SQL database, and a Key Vault all needed to be removed from public internet reachability, what single Phase 3 mechanism would you apply to all three, and why does it work the same way across different PaaS resource types?
• Why does Microsoft Entra Private Access represent a genuinely different trust model from VPN, rather than just a more modern implementation of the same idea?