You are designing a Zero Trust approach for a multi-tier application consisting of a web front end on App Service, microservices on AKS, and a database on Azure SQL Managed Instance. You must enforce micro-segmentation between tiers, require strong identity verification for users and admins, and ensure least-privilege access for administrative roles. Which two actions should you implement? Each correct answer presents part of the solution.

The first correct option implements micro-segmentation. NSGs with Application Security Groups (ASGs) allow granular network control based on application workloads, restricting traffic between the App Service front end and other tiers. Private Link secures connectivity to Azure SQL Managed Instance over a private endpoint, avoiding public exposure. AKS network policies (like Calico) enforce micro-segmentation within the Kubernetes cluster, controlling pod-to-pod and pod-to-service communication. The second correct option addresses strong identity verification and least-privilege access. Conditional Access policies enforce phishing-resistant MFA and device compliance for administrative access, strengthening identity verification. Privileged Identity Management (PIM) with just-in-time (JIT) activation and approval workflows ensures administrative roles are only active when needed, adhering to least-privilege principles.