That observation would primarily validate another control: evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. ExpressRoute Direct offers dedicated port pairs for creating supported ExpressRoute circuits at high scale. The situation calls for evidence that the BGP session reaches established state and correct advertised routes are visible.

That observation would primarily validate another control: configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. The situation calls for evidence that the BGP session reaches established state and correct advertised routes are visible.

That observation would primarily validate another control: inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. Circuit health and private peering do not guarantee a workload selects that route over more specific UDR entries. The situation calls for evidence that the BGP session reaches established state and correct advertised routes are visible.

That observation would primarily validate another control: deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP. The inbound endpoint accepts hybrid DNS queries and can resolve private zones linked to its VNet. The situation calls for evidence that internal clients receive approved private records while external public clients see only intended public records.

That observation would primarily validate another control: apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. DNS-layer policy can block known malicious domains without treating an IP firewall allow rule as DNS security. The situation calls for evidence that internal clients receive approved private records while external public clients see only intended public records.

That observation would primarily validate another control: create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs. Private Link connectivity commonly depends on the appropriate privatelink DNS zone and VNet link. The situation calls for evidence that internal clients receive approved private records while external public clients see only intended public records.

That observation would primarily validate another control: sequence private endpoint approval, private DNS, connectivity testing and then public network restriction. Disabling the public endpoint before validating private name resolution and routes can cause an avoidable outage. The situation calls for evidence that the consumer reaches the authorized service endpoint but cannot route to unrelated provider subnet IPs.

That observation would primarily validate another control: check resource-specific Private Link support, subresource group IDs and regional availability before implementation. Private endpoint connectivity depends on the destination service's supported private link capabilities. The situation calls for evidence that the consumer reaches the authorized service endpoint but cannot route to unrelated provider subnet IPs.

That observation would primarily validate another control: provide separate approved private endpoints for each consumer to the shared eligible Private Link service. A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. The situation calls for evidence that the consumer reaches the authorized service endpoint but cannot route to unrelated provider subnet IPs.

That observation would primarily validate another control: use WAF diagnostic logs to identify matched policy, rule and client/request details. Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. The situation calls for evidence that the legitimate form succeeds and unrelated malicious-pattern test traffic remains blocked.

That observation would primarily validate another control: define WAF custom geographic match rules or supported edge access controls for the target domains. Geographic filtering requires explicit request-based policy and should not be confused with backend origin placement. The situation calls for evidence that the legitimate form succeeds and unrelated malicious-pattern test traffic remains blocked.

That observation would primarily validate another control: limit WAF exclusions to the smallest required match variable, field or rule. Broad WAF exclusions create avoidable blind spots while a targeted exception can preserve other detection coverage. The situation calls for evidence that the legitimate form succeeds and unrelated malicious-pattern test traffic remains blocked.

Gateway SKUs have deployment and capacity requirements that must be met by the dedicated reserved subnet. However, the option would implement resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU; the scenario instead requires check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes. The differentiating evidence is that the packet path is identified and a corrected route sends traffic over the intended active tunnel.

A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. However, the option would implement update local network gateway address spaces or validated BGP advertisements for the missing prefix; the scenario instead requires check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes. The differentiating evidence is that the packet path is identified and a corrected route sends traffic over the intended active tunnel.

Internet-bound branch traffic requires explicit default-route propagation and a compatible secured hub path. However, the option would implement design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing; the scenario instead requires check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes. The differentiating evidence is that the packet path is identified and a corrected route sends traffic over the intended active tunnel.

Inbound NAT rules target specific backend machines instead of spreading a flow across a load-balanced pool. However, the option would implement create inbound NAT rules that map unique frontend ports to designated backend endpoints; the scenario instead requires configure Traffic Manager Weighted routing across the regional endpoints. The differentiating evidence is that a statistically meaningful set of test DNS answers reflects the configured relative weights.

Gateway Load Balancer integrates compatible NVAs into traffic flow without application-layer URL routing. However, the option would implement use Gateway Load Balancer and a supported transparent NVA service-chain configuration; the scenario instead requires configure Traffic Manager Weighted routing across the regional endpoints. The differentiating evidence is that a statistically meaningful set of test DNS answers reflects the configured relative weights.

High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. However, the option would implement configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules; the scenario instead requires configure Traffic Manager Weighted routing across the regional endpoints. The differentiating evidence is that a statistically meaningful set of test DNS answers reflects the configured relative weights.

That observation would primarily validate another control: use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes. Connection troubleshoot evaluates the actual source-to-destination path rather than guessing from VM health status. The situation calls for evidence that the analyst retrieves a time-bounded flow record for a representative deny and validates source and destination fields.

That observation would primarily validate another control: use Defender for Cloud attack path analysis to identify exploitable exposure chains. Attack path analysis evaluates connected weaknesses rather than treating each network setting in isolation. The situation calls for evidence that the analyst retrieves a time-bounded flow record for a representative deny and validates source and destination fields.

That observation would primarily validate another control: inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. Backend availability depends on probe reachability and network/security rules, not simply process existence. The situation calls for evidence that the analyst retrieves a time-bounded flow record for a representative deny and validates source and destination fields.

That observation would primarily validate another control: provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway. Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. The situation calls for evidence that the configured service is accepted by the subnet and deployment validation no longer reports delegation conflicts.

That observation would primarily validate another control: define address and segmentation standards in IaC with governance checks before production deployment. Reproducible network definitions and validation catch overlapping or noncompliant ranges before live peering. The situation calls for evidence that the configured service is accepted by the subnet and deployment validation no longer reports delegation conflicts.

That observation would primarily validate another control: create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services. Gateway, Bastion, Firewall, private endpoint and application delivery components require space and specific subnet planning. The situation calls for evidence that the configured service is accepted by the subnet and deployment validation no longer reports delegation conflicts.

That observation would primarily validate another control: define WAF custom geographic match rules or supported edge access controls for the target domains. Geographic filtering requires explicit request-based policy and should not be confused with backend origin placement. The situation calls for evidence that the payment use case succeeds and approved safe attack tests still trigger expected protection.

That observation would primarily validate another control: limit WAF exclusions to the smallest required match variable, field or rule. Broad WAF exclusions create avoidable blind spots while a targeted exception can preserve other detection coverage. The situation calls for evidence that the payment use case succeeds and approved safe attack tests still trigger expected protection.

That observation would primarily validate another control: use WAF diagnostic logs to identify matched policy, rule and client/request details. Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. The situation calls for evidence that the payment use case succeeds and approved safe attack tests still trigger expected protection.

Network allow lists and data-plane authorization are independent controls. However, the option would implement combine service endpoint network rules with proper service authentication and RBAC or access policies; the scenario instead requires add the selected VNet/subnet to the target service's virtual network access rules. The differentiating evidence is that a client on the allowed subnet connects and a test client outside the service firewall rules is denied.

Service endpoint traffic is governed by virtual network identity and service firewall rules. However, the option would implement review service endpoint behavior and update the target service's VNet network rules rather than relying only on public egress IPs; the scenario instead requires add the selected VNet/subnet to the target service's virtual network access rules. The differentiating evidence is that a client on the allowed subnet connects and a test client outside the service firewall rules is denied.

Service endpoints are configured at subnet level, not automatically across an entire VNet. However, the option would implement enable the supported service endpoint on each specific subnet that requires the Azure service network identity; the scenario instead requires add the selected VNet/subnet to the target service's virtual network access rules. The differentiating evidence is that a client on the allowed subnet connects and a test client outside the service firewall rules is denied.

That observation would primarily validate another control: choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed. Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. The situation calls for evidence that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

That observation would primarily validate another control: update the local network gateway resource with the remote VPN device public IP and correct prefixes. Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. The situation calls for evidence that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

That observation would primarily validate another control: deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. The situation calls for evidence that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.