That observation would primarily validate another control: deploy Azure Front Door with appropriate origin groups and endpoint routes. Front Door is a globally distributed application delivery service that proxies and routes HTTP(S) traffic to healthy origins. The situation calls for evidence that a fresh request after purge returns updated origin content rather than the old cached version.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that a fresh request after purge returns updated origin content rather than the old cached version.

That observation would primarily validate another control: place Front Door in front of appropriate regional origin gateways with correct host headers and probes. Front Door provides global entry and acceleration, while regional gateways retain local layer-7 capabilities. The situation calls for evidence that a fresh request after purge returns updated origin content rather than the old cached version.

Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. However, the option would implement deploy Azure Firewall into a supported hub and route workload egress through its private IP; the scenario instead requires use supported Azure Firewall FQDN tags or service-aware policy features where applicable. The differentiating evidence is that the intended Azure service stays reachable after endpoint changes without permitting unrelated public destinations.

Central inspection is effective only if the policy meaningfully restricts destination and transport access. However, the option would implement replace blanket allows with least-privilege application and network rule collections; the scenario instead requires use supported Azure Firewall FQDN tags or service-aware policy features where applicable. The differentiating evidence is that the intended Azure service stays reachable after endpoint changes without permitting unrelated public destinations.

Basic, Standard and Premium tiers have different security capabilities and capacity. However, the option would implement choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost; the scenario instead requires use supported Azure Firewall FQDN tags or service-aware policy features where applicable. The differentiating evidence is that the intended Azure service stays reachable after endpoint changes without permitting unrelated public destinations.

Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. However, the option would implement inspect effective security rules and IP flow verify for the exact source, destination, protocol and port; the scenario instead requires update NSG source or ASG membership for the new workload placement after validating its identity. The differentiating evidence is that a packet from the new authorized subnet is allowed while the old unintended source no longer has access.

An unattached NSG does not evaluate workload traffic merely because its resource exists. However, the option would implement associate the NSG with the actual target subnet or network interface and validate effective policy; the scenario instead requires update NSG source or ASG membership for the new workload placement after validating its identity. The differentiating evidence is that a packet from the new authorized subnet is allowed while the old unintended source no longer has access.

Security admin rules can centrally enforce network intent across managed VNet groups. However, the option would implement use Azure Virtual Network Manager security admin configurations within supported scope; the scenario instead requires update NSG source or ASG membership for the new workload placement after validating its identity. The differentiating evidence is that a packet from the new authorized subnet is allowed while the old unintended source no longer has access.

That observation would primarily validate another control: design an explicit routed transit path using an NVA or supported hub routing architecture. VNet peering is not intrinsically transitive; a route or gateway strategy is required for spoke-to-spoke transit. The situation calls for evidence that an effective-route check selects the intended specific prefix and test packets reach the right target.

That observation would primarily validate another control: compare effective routes and correct the conflicting UDR or route-propagation setting. A working BGP control plane does not guarantee the desired next hop when route tables override propagated paths. The situation calls for evidence that an effective-route check selects the intended specific prefix and test packets reach the right target.

That observation would primarily validate another control: enable appropriate forwarded traffic settings on the relevant peering connections and retain correct return routes. Traffic forwarded by an NVA requires compatible peering settings as well as layer-3 routing. The situation calls for evidence that an effective-route check selects the intended specific prefix and test packets reach the right target.

An unattached NSG does not evaluate workload traffic merely because its resource exists. However, the option would implement associate the NSG with the actual target subnet or network interface and validate effective policy; the scenario instead requires update NSG source or ASG membership for the new workload placement after validating its identity. The differentiating evidence is that a packet from the new authorized subnet is allowed while the old unintended source no longer has access.

NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. However, the option would implement correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering; the scenario instead requires update NSG source or ASG membership for the new workload placement after validating its identity. The differentiating evidence is that a packet from the new authorized subnet is allowed while the old unintended source no longer has access.

A missing application log can result from network filtering or an unavailable listener; both need evidence. However, the option would implement use Network Watcher connection testing and IP flow verify alongside service listener checks; the scenario instead requires update NSG source or ASG membership for the new workload placement after validating its identity. The differentiating evidence is that a packet from the new authorized subnet is allowed while the old unintended source no longer has access.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that a request through Front Door succeeds and an unrelated direct-origin test is rejected.

That observation would primarily validate another control: configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content. Front Door edge caching improves static content delivery only when caching policies respect dynamic or private data. The situation calls for evidence that a request through Front Door succeeds and an unrelated direct-origin test is rejected.

That observation would primarily validate another control: create Front Door rules for supported redirect or URL rewrite behavior on the matching route. Front Door rules can modify edge request handling before forwarding to origin services. The situation calls for evidence that a request through Front Door succeeds and an unrelated direct-origin test is rejected.

That observation would primarily validate another control: store NSG configurations in versioned IaC and validate effective rules before and after deployment. Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. The situation calls for evidence that a test east-west flow produces the expected VNet flow record in the selected log destination.

That observation would primarily validate another control: update NSG source or ASG membership for the new workload placement after validating its identity. IP-prefix and application security group membership determine which NSG rules match relocated workloads. The situation calls for evidence that a test east-west flow produces the expected VNet flow record in the selected log destination.

That observation would primarily validate another control: create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. The situation calls for evidence that a test east-west flow produces the expected VNet flow record in the selected log destination.

That observation would primarily validate another control: separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. Name resolution visibility is determined by private-zone linking and namespace selection. The situation calls for evidence that lookups through the VNet's configured DNS server return private endpoint addresses for the zone suffix.

That observation would primarily validate another control: link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path. Inbound Private Resolver resolves private zones available through its network's DNS resolution context. The situation calls for evidence that lookups through the VNet's configured DNS server return private endpoint addresses for the zone suffix.

That observation would primarily validate another control: remove a self-referential forwarding ruleset link or rule to prevent a resolver forwarding loop. Forwarding to an inbound endpoint from a ruleset linked to that same resolver VNet can cause a DNS loop. The situation calls for evidence that lookups through the VNet's configured DNS server return private endpoint addresses for the zone suffix.

Service endpoint policies can narrow egress to supported Azure service resources rather than all accounts. However, the option would implement apply supported service endpoint policies with the authorized storage resource definitions; the scenario instead requires keep normal public service DNS and validate service endpoint route and subnet network-rule behavior. The differentiating evidence is that dNS retains expected public service records while approved subnet access succeeds under the service firewall.

Service endpoint traffic is governed by virtual network identity and service firewall rules. However, the option would implement review service endpoint behavior and update the target service's VNet network rules rather than relying only on public egress IPs; the scenario instead requires keep normal public service DNS and validate service endpoint route and subnet network-rule behavior. The differentiating evidence is that dNS retains expected public service records while approved subnet access succeeds under the service firewall.

Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. However, the option would implement use a private endpoint instead of a service endpoint for private-IP service access; the scenario instead requires keep normal public service DNS and validate service endpoint route and subnet network-rule behavior. The differentiating evidence is that dNS retains expected public service records while approved subnet access succeeds under the service firewall.

Inbound NAT rules target specific backend machines instead of spreading a flow across a load-balanced pool. However, the option would implement create inbound NAT rules that map unique frontend ports to designated backend endpoints; the scenario instead requires use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers. The differentiating evidence is that a controlled region outage directs a new eligible client flow to a healthy regional backend.

Performance routing maps DNS clients to suitable regional endpoints using the Traffic Manager performance model. However, the option would implement use Traffic Manager Performance routing with enabled healthy endpoints; the scenario instead requires use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers. The differentiating evidence is that a controlled region outage directs a new eligible client flow to a healthy regional backend.

High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. However, the option would implement configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules; the scenario instead requires use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers. The differentiating evidence is that a controlled region outage directs a new eligible client flow to a healthy regional backend.

FastPath can improve the data path for supported ExpressRoute configurations by bypassing the gateway dataplane. However, the option would implement enable ExpressRoute FastPath on compatible circuits, gateways and network resources; the scenario instead requires select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. The differentiating evidence is that the two target regions can attach through the designed service and verify permitted test traffic.

Cloud exchange, point-to-point and other provider models have different operational and physical requirements. However, the option would implement choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning; the scenario instead requires select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. The differentiating evidence is that the two target regions can attach through the designed service and verify permitted test traffic.

BFD can detect forwarding failures rapidly and inform BGP convergence where supported. However, the option would implement use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration; the scenario instead requires select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. The differentiating evidence is that the two target regions can attach through the designed service and verify permitted test traffic.