Exercise 2: Tracing Least Privilege Through Azure's Own Real Architecture — Possible Solution
====================================================================

Least privilege appears at multiple real, distinct points in this
capstone's own architecture, mirroring the same discipline AWS
Fundamentals' own capstone applied, expressed through Azure's own
different real mechanisms:

1. STEP 2 (Managed Identity role assignment): scoped to Contributor,
   not Owner, at the Resource Group level - only what's needed to
   manage resources, never the ability to grant access to others. If
   this were instead an Owner assignment, a compromised VM could
   modify permissions for every other identity in the Resource Group,
   not just manage its own resources.

2. STEP 4 (web VM's own NSG): allows inbound traffic only from
   Application Gateway, not directly from the internet. Without this,
   the web VM would be directly reachable by anyone, bypassing
   Application Gateway's own health-check-based traffic management
   and WAF protection entirely.

3. STEP 5 (SAS token scoping): any SAS tokens issued are scoped
   narrowly to the one specific photo container, with a genuine real
   expiration date - directly learned from Chapter 4's own 2023
   Microsoft AI research leak, where an overscoped, effectively
   permanent SAS token exposed 38TB of unrelated data. Without this
   real scoping discipline, a leaked token here could expose far more
   than just the application's own intended photo data.

4. STEP 6 (Azure SQL Database, presumably firewall-scoped to only the
   web VM's own subnet, though not stated explicitly): without
   real network-level restriction, the database could be reached
   directly from outside the intended application, not only from the
   specific web tier that legitimately needs to query it.

ANSWER: Least privilege is applied at the Managed Identity's own role
scope (Step 2), the web VM's NSG (Step 4), and the SAS token scoping
for Blob Storage (Step 5) - three real, distinct points, each
preventing a single compromise from reaching more of the environment
than that specific component actually needs to touch.

WHY THIS WORKS AS AN ANSWER
------------------------------
This identifies every real, distinct point where the principle is
applied using Azure's own specific mechanisms (RBAC scope, NSGs, SAS
token scoping) rather than simply restating "least privilege matters"
in the abstract, and explicitly ties Step 5 back to the real, concrete
consequence demonstrated in Chapter 4's own case study.