You are securing a tiered web application that handles customer PII. In phase one, you must minimize blast radius, restrict privileged access, and assume breach. A formal data classification rollout will start next quarter. Which two design decisions should you implement now?

The correct options directly address minimizing blast radius, restricting privileged access, and assuming breach. Defense in depth with WAF, Firewall, NSGs/ASGs, and Private Endpoints creates multiple layers of protection and limits network exposure, reducing the impact of a breach. Implementing least privilege with RBAC, PIM, managed identities, and Key Vault ensures that access is granted only when necessary, for the shortest duration, and through secure means, directly restricting privileged access and supporting the "assume breach" principle by limiting potential damage. Granting the Owner role to all engineers violates the principle of least privilege and increases the blast radius. Using a single generic data label and relying solely on encryption-at-rest is insufficient for robust data classification and protection, especially with PII. Immediately enforcing DLP without stakeholder input or discovery is impractical and likely to cause operational disruption, as a formal data classification rollout is planned for the next quarter.