SC-500 decision sheets

• Defender for Cloud and Sentinel: which capability for which posture goal
• Defender for Servers: agentless scanning vs MDE extension vs guest attestation
• Key Vault built-in roles: Reader vs Certificate User vs Crypto Officer vs Crypto User
• Key Vault RBAC vs access policy model, and the Contributor escalation path
• NSG default rules and evaluation: DenyAllInbound, AllowVNetInBound, statefulness
• PIM eligible vs active vs permanent, and where scope and activation controls live
• Private endpoint behaviour: what a private IP does and does not do
• Azure Virtual Network Manager security admin rules vs NSG rules
• Security Copilot access: platform roles vs Entra roles vs plugin RBAC
• Always Encrypted vs TDE vs dynamic data masking vs row-level security vs Ledger
• Storage account controls: shared key vs SAS revocation vs immutability vs locks
• Storage network path: private endpoint vs routing preference vs anonymous access vs firewall
• VM and backup disk encryption: SSE with CMK vs PMK vs ADE vs encryption at host
• VM security type: Standard vs Trusted Launch vs Confidential VM
• Workload identity types: app object vs service principal vs managed identity