Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.
6.2. Quick Reference
🎯 Quick Reference: "Which Control Handles This?"
| If the Scenario Describes... | The Answer Is Usually... | Covered In |
|---|---|---|
| Standing admin access that should be time-bound | Privileged Identity Management | 2.1.1 |
| Access decision based on risk, location, or device | Conditional Access | 2.1.2 |
| A connection string or hardcoded key in code | Managed identity | 2.1.6 |
| Vault access working over the network but denied by permission | Check permission model (access policy vs. RBAC) | 2.2.2 |
| A hardcoded secret found outside Key Vault entirely | Defender CSPM secret scanning | 2.2.4 |
| Resources allowed to have insecure configurations regardless of who deploys them | Azure Policy (Deny effect) | 2.3.1 |
| An authorized user accidentally deleting a critical resource | Resource lock (CanNotDelete) | 2.3.3 |
| A Contributor unable to grant others access (as expected) | This is correct behavior — RBAC by design | 2.3.4 |
| Data path still exposed despite tight storage firewall rules | Check SAS tokens / shared key access | 3.1.1 |
| Central team needs to override a local NSG rule | Virtual Network Manager security admin rules | 3.3.2 |
| Reducing lateral movement risk from remote access | Microsoft Entra Private Access, not "more VPN" | 3.3.3 |
| Removing a PaaS resource from public reachability entirely | Private Endpoint / Private Link | 3.3.4 |
| Copilot surfacing content a user "already had access to" | Still an oversharing risk — Purview DSPM for AI | 4.1.1 |
| Assessing what's reachable if an AI agent's credentials leak | Entra Agent ID blast radius analysis (Defender XDR) | 4.1.3 |
| Unpredictable AI compute cost from unbounded usage | AI Gateway in API Management | 4.1.4 |
| Actively blocking a malicious prompt in real time | Foundry guardrails, not Defender for AI Service | 4.1.5 |
| Zero public IP exposure for VM management access | Azure Bastion | 4.2.2 |
| Narrowing an exposure window without removing reachability | Just-in-time VM access | 4.2.2 |
| Extending Azure security tooling to on-prem/other-cloud servers | Azure Arc | 4.2.3 |
| Enforcing an in-guest OS setting (not just a resource property) | Azure Machine Configuration | 4.2.5 |
| Finding forgotten, unmanaged internet-facing assets | Defender EASM | 5.1.3 |
| Automatically running a Logic App when an incident is created | Automation rule → playbook | 5.2.3 |
| Investigating a mailbox permission change during an incident | Query Purview Audit from Defender XDR | 5.2.4 |
🎯 Quick Reference: Domain Weight Priorities
| Domain | Weight | If Short on Time, Prioritize |
|---|---|---|
| Secure storage, databases, networking | 25-30% | Private Link/Private Endpoints, NSG vs. Firewall distinction, VPN vs. Private Access |
| Manage identity, access, governance | 20-25% | PIM eligible vs. active, Conditional Access, Policy vs. RBAC |
| Secure compute (incl. AI) | 20-25% | Entra Agent ID + blast radius, AI Gateway vs. guardrails vs. Defender for AI, JIT vs. Bastion |
| Manage and monitor security posture | 20-25% | CSPM vs. workload protection, automation rules vs. playbooks, Vulnerability Management vs. EASM |
🎯 Quick Reference: Three Cross-Domain Decision Flows
"Is this exposed, and to what?" — the network-plus-identity check that recurs across storage (3.1), Key Vault (2.2.2), and databases (3.2):
"Which AI control actually applies?" — collapsing the five-way AI security decision from 4.1 into one flow:
"Prevent, detect, or respond?" — the Phase 1 framework applied across all four domains at a glance:
Written byAlvin Varughese
Founder•18 professional certifications