Governance and identity protection often trip up exam candidates because of overlapping tools (RBAC vs Policy, Defender vs Sentinel, TDE vs Always Encrypted). Many questions are scenario-based, testing whether you choose the right control at the right layer.
This capsule summarizes pitfalls, best practices, and strategies to ace governance-related questions.
Common Pitfalls
1. Confusing RBAC vs Policy
-
RBAC = controls who can do what.
-
Policy = controls what can be deployed/configured.
Exam Trap: If the question says “users should not deploy VMs outside EU”, the answer is Policy, not RBAC.
2. Ignoring Management Groups
-
Many candidates limit governance to Subscriptions.
-
MGs allow enterprise-wide policy enforcement.
3. Overlooking Key Vault in Data Security
-
Some assume encryption is automatic.
-
TDE is default for SQL DB, but CMK (customer-managed keys) requires Key Vault integration.
4. Confusing TDE vs Always Encrypted
-
TDE = database-level encryption at rest.
-
Always Encrypted = column-level encryption for sensitive data.
Exam Trap: If DBA must not see SSNs, answer is Always Encrypted, not TDE.
5. Misusing MFA & Conditional Access
-
MFA = method of authentication.
-
Conditional Access = policy engine that enforces MFA under specific conditions.
6. PIM Misconception
-
PIM = temporary elevation.
-
RBAC alone does not provide JIT access.
7. Sentinel vs Defender for Cloud
-
Defender = posture + compliance checks.
-
Sentinel = incident detection + response.
Exam Trap: If question is about “compliance with ISO/NIST” → Defender. If about “detecting attacks in real time” → Sentinel.
Best Practices
-
Always apply Policies at Management Group level for consistency.
-
Use RBAC + PIM together (least privilege + JIT access).
-
Enforce MFA for all admins using Conditional Access.
-
Protect secrets with Key Vault + RBAC.
-
Use Defender for Cloud for continuous compliance, and Sentinel for active detection.
Quick Recall Table
| Requirement | Best Solution |
|---|---|
| Restrict resource deployment regions | Azure Policy |
| Separate billing + access boundary | Subscription |
| Enterprise-wide policy enforcement | Management Groups |
| Least privilege access | RBAC |
| Temporary elevation of Global Admin | PIM |
| Encrypt SQL DB at rest | TDE |
| Ensure DBAs cannot read sensitive columns | Always Encrypted |
| Store encryption keys securely | Azure Key Vault |
| Compliance dashboard for PCI, ISO, HIPAA | Defender for Cloud |
| Detect and auto-respond to suspicious activity | Microsoft Sentinel |
Exam Tips
-
“Which feature prevents users from deploying resources outside West Europe?” → Azure Policy.
-
“Which governance container organizes subscriptions?” → Management Groups.
-
“Which feature enforces JIT admin access?” → PIM.
-
“Which feature encrypts SQL DB backups automatically?” → TDE.
-
“Which encryption ensures even DBAs can’t see customer SSNs?” → Always Encrypted.
-
“Which service provides PCI DSS compliance checks?” → Defender for Cloud.
-
“Which service correlates logs to detect suspicious logins?” → Sentinel.
What to Expect in the Exam
-
Direct Q: “Which feature enforces tagging for cost tracking?” → Azure Policy.
-
Scenario Q: “Company requires time-limited access to Global Admin role.” → PIM.
-
Scenario Q: “Healthcare provider must encrypt SQL data with customer-managed keys.” → TDE with CMK in Key Vault.
-
Scenario Q: “Retailer needs to detect and block malicious login attempts in real time.” → Sentinel with Playbooks.
-
Trick Q: “RBAC prevents deployment of untagged resources.” → False (Policy does).