Load balancing applies only to members registered in its backend pool and passing health checks. However, the option would implement register eligible NIC IP configurations or supported resources in the load balancer backend pool; the scenario instead requires use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing. The differentiating evidence is that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

Weighted Traffic Manager policies influence DNS answer distribution across eligible healthy endpoints. However, the option would implement configure Traffic Manager Weighted routing across the regional endpoints; the scenario instead requires use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing. The differentiating evidence is that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. However, the option would implement configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules; the scenario instead requires use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing. The differentiating evidence is that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

That observation would primarily validate another control: enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs. DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. The situation calls for evidence that flow records capture approved test connections and can be queried in the selected analysis destination.

That observation would primarily validate another control: use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes. Connection troubleshoot evaluates the actual source-to-destination path rather than guessing from VM health status. The situation calls for evidence that flow records capture approved test connections and can be queried in the selected analysis destination.

That observation would primarily validate another control: route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. Collecting network flows is useful only if relevant logs reach an authorized searchable destination. The situation calls for evidence that flow records capture approved test connections and can be queried in the selected analysis destination.

Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. However, the option would implement provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway; the scenario instead requires provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall. The differentiating evidence is that the managed firewall instance provisions successfully in the reserved subnet and receives its intended private IP.

Connected peers and gateways must recognize updated prefixes and traffic cannot rely on stale addressing during migration. However, the option would implement plan address-space updates with peering synchronization and dependency validation before routing cutover; the scenario instead requires provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall. The differentiating evidence is that the managed firewall instance provisions successfully in the reserved subnet and receives its intended private IP.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall. The differentiating evidence is that the managed firewall instance provisions successfully in the reserved subnet and receives its intended private IP.

That observation would primarily validate another control: review and configure supported private endpoint network policies and the associated subnet routes deliberately. Private endpoint policy support and traffic paths must be consistent with the desired inspection/segmentation design. The situation calls for evidence that the application passes private-path tests before public ingress is disabled and stays healthy afterward.

That observation would primarily validate another control: check resource-specific Private Link support, subresource group IDs and regional availability before implementation. Private endpoint connectivity depends on the destination service's supported private link capabilities. The situation calls for evidence that the application passes private-path tests before public ingress is disabled and stays healthy afterward.

That observation would primarily validate another control: require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. Connection approval separates consumer endpoint provisioning from provider authorization. The situation calls for evidence that the application passes private-path tests before public ingress is disabled and stays healthy afterward.

That observation would primarily validate another control: match NSG rules to the effective private source and destination packet addresses at the NIC boundary. NSG policy evaluation sees packet addresses at its network scope rather than assuming Internet NAT addresses. The situation calls for evidence that the failing flow is attributed to a specific NSG decision or listener issue and the correct fix is confirmed.

That observation would primarily validate another control: create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. The situation calls for evidence that the failing flow is attributed to a specific NSG decision or listener issue and the correct fix is confirmed.

That observation would primarily validate another control: use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. Direct Internet-wide RDP exposure is unnecessary when managed private administration is available. The situation calls for evidence that the failing flow is attributed to a specific NSG decision or listener issue and the correct fix is confirmed.

That observation would primarily validate another control: configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content. Front Door edge caching improves static content delivery only when caching policies respect dynamic or private data. The situation calls for evidence that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

That observation would primarily validate another control: configure Front Door origin-group health probes and suitable priority or weight settings. Front Door origin selection depends on health probes and configured origin priority or weight. The situation calls for evidence that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

That observation would primarily validate another control: create specific Front Door routes matching the intended domain and path patterns to origin groups. A route connects domain/path matching with the origin group and forwarding behavior. The situation calls for evidence that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

That observation would primarily validate another control: use a private endpoint instead of a service endpoint for private-IP service access. Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. The situation calls for evidence that the approved client connects privately after old service endpoint rules are removed and unrelated requests remain denied.

That observation would primarily validate another control: combine service endpoint network rules with proper service authentication and RBAC or access policies. Network allow lists and data-plane authorization are independent controls. The situation calls for evidence that the approved client connects privately after old service endpoint rules are removed and unrelated requests remain denied.

That observation would primarily validate another control: enable the supported service endpoint on each specific subnet that requires the Azure service network identity. Service endpoints are configured at subnet level, not automatically across an entire VNet. The situation calls for evidence that the approved client connects privately after old service endpoint rules are removed and unrelated requests remain denied.

Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. However, the option would implement use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance; the scenario instead requires select Azure Firewall Premium and configure supported TLS inspection and IDPS settings. The differentiating evidence is that an approved safe detection sample produces an IDPS event and permitted TLS traffic is inspected without certificate errors.

Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. However, the option would implement configure a DNAT rule with the intended public destination, private target and matching security controls; the scenario instead requires select Azure Firewall Premium and configure supported TLS inspection and IDPS settings. The differentiating evidence is that an approved safe detection sample produces an IDPS event and permitted TLS traffic is inspected without certificate errors.

NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. However, the option would implement combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth; the scenario instead requires select Azure Firewall Premium and configure supported TLS inspection and IDPS settings. The differentiating evidence is that an approved safe detection sample produces an IDPS event and permitted TLS traffic is inspected without certificate errors.

That observation would primarily validate another control: apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. Forced tunneling through an appliance requires an explicit default route from the workload subnet. The situation calls for evidence that a probe between spokes follows the approved transit hop and reverse traffic returns over a valid path.

That observation would primarily validate another control: inspect the effective-route longest-prefix match and add the proper more-specific route where supported. Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. The situation calls for evidence that a probe between spokes follows the approved transit hop and reverse traffic returns over a valid path.

That observation would primarily validate another control: respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. The situation calls for evidence that a probe between spokes follows the approved transit hop and reverse traffic returns over a valid path.

That observation would primarily validate another control: use ExpressRoute Global Reach between eligible circuits and confirm support across their locations. Global Reach connects supported on-premises networks through eligible ExpressRoute circuit relationships. The situation calls for evidence that an approved packet inspection or tunnel check confirms encryption on the required connection segment.

That observation would primarily validate another control: select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. The situation calls for evidence that an approved packet inspection or tunnel check confirms encryption on the required connection segment.

That observation would primarily validate another control: provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. ExpressRoute provides private connectivity through a provider path, subject to service and circuit design. The situation calls for evidence that an approved packet inspection or tunnel check confirms encryption on the required connection segment.

That observation would primarily validate another control: deploy Azure Front Door with appropriate origin groups and endpoint routes. Front Door is a globally distributed application delivery service that proxies and routes HTTP(S) traffic to healthy origins. The situation calls for evidence that a fresh request after purge returns updated origin content rather than the old cached version.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that a fresh request after purge returns updated origin content rather than the old cached version.

That observation would primarily validate another control: place Front Door in front of appropriate regional origin gateways with correct host headers and probes. Front Door provides global entry and acceleration, while regional gateways retain local layer-7 capabilities. The situation calls for evidence that a fresh request after purge returns updated origin content rather than the old cached version.