A missing application log can result from network filtering or an unavailable listener; both need evidence. However, the option would implement use Network Watcher connection testing and IP flow verify alongside service listener checks; the scenario instead requires use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. The differentiating evidence is that authorized staff connect by the approved management path and open Internet RDP tests are denied.

An unattached NSG does not evaluate workload traffic merely because its resource exists. However, the option would implement associate the NSG with the actual target subnet or network interface and validate effective policy; the scenario instead requires use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. The differentiating evidence is that authorized staff connect by the approved management path and open Internet RDP tests are denied.

Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. However, the option would implement create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route; the scenario instead requires use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. The differentiating evidence is that authorized staff connect by the approved management path and open Internet RDP tests are denied.

That observation would primarily validate another control: start the WAF in detection mode, review matched rules and then enable prevention after tuning. Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. The situation calls for evidence that a permitted-region test succeeds and a restricted-region test follows the configured deny response.

That observation would primarily validate another control: apply a narrowly scoped WAF exclusion or supported per-rule override instead of disabling all protection. Targeted tuning preserves the broader managed rule set while addressing a justified false positive. The situation calls for evidence that a permitted-region test succeeds and a restricted-region test follows the configured deny response.

That observation would primarily validate another control: limit WAF exclusions to the smallest required match variable, field or rule. Broad WAF exclusions create avoidable blind spots while a targeted exception can preserve other detection coverage. The situation calls for evidence that a permitted-region test succeeds and a restricted-region test follows the configured deny response.

ASGs identify groups of NICs for rule targets without hard-coding changing workload IPs. However, the option would implement create an application security group and reference it in supported NSG rules for member network interfaces; the scenario instead requires configure supported private endpoint network-policy settings and relevant NSG rules where enabled. The differentiating evidence is that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

Direct Internet-wide RDP exposure is unnecessary when managed private administration is available. However, the option would implement use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress; the scenario instead requires configure supported private endpoint network-policy settings and relevant NSG rules where enabled. The differentiating evidence is that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. However, the option would implement store NSG configurations in versioned IaC and validate effective rules before and after deployment; the scenario instead requires configure supported private endpoint network-policy settings and relevant NSG rules where enabled. The differentiating evidence is that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

That observation would primarily validate another control: associate the intended route table with every subnet that must use that UDR policy. UDRs affect only subnets to which their route table is associated. The situation calls for evidence that a test VM's effective route and packet path show the intended appliance rather than unexpected NAT egress.

That observation would primarily validate another control: use Azure Route Server with a supported BGP peer to exchange routes dynamically. Route Server exchanges BGP information with compatible appliances and Azure networking instead of relying on static edits. The situation calls for evidence that a test VM's effective route and packet path show the intended appliance rather than unexpected NAT egress.

That observation would primarily validate another control: attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet. NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. The situation calls for evidence that a test VM's effective route and packet path show the intended appliance rather than unexpected NAT egress.

That observation would primarily validate another control: inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. The situation calls for evidence that the target NIC shows expected effective rules and an authorized allow/deny test confirms enforcement.

That observation would primarily validate another control: check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies. Both subnet and NIC security groups participate in evaluating traffic, so one permissive rule is insufficient. The situation calls for evidence that the target NIC shows expected effective rules and an authorized allow/deny test confirms enforcement.

That observation would primarily validate another control: use Network Watcher connection testing and IP flow verify alongside service listener checks. A missing application log can result from network filtering or an unavailable listener; both need evidence. The situation calls for evidence that the target NIC shows expected effective rules and an authorized allow/deny test confirms enforcement.

That observation would primarily validate another control: configure supported WAF rate-limit or bot protection rules at the appropriate edge scope. WAF custom rate limits and bot controls can mitigate application-layer request floods when correctly scoped. The situation calls for evidence that a permitted-region test succeeds and a restricted-region test follows the configured deny response.

That observation would primarily validate another control: change the tuned WAF policy to prevention mode and confirm the intended managed rule action. Prevention mode can block matching HTTP requests, while detection mode is nonblocking. The situation calls for evidence that a permitted-region test succeeds and a restricted-region test follows the configured deny response.

That observation would primarily validate another control: review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence. Managed rule set versions can change match behavior and should be tested against legitimate traffic. The situation calls for evidence that a permitted-region test succeeds and a restricted-region test follows the configured deny response.

That observation would primarily validate another control: select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features. Basic and Standard Virtual WAN SKUs expose different hub and connectivity capabilities. The situation calls for evidence that a permitted remote user establishes a client tunnel and reaches the assigned resource route.

That observation would primarily validate another control: choose the appropriate Virtual WAN hub gateway scale units and capacity parameters. Different Virtual WAN gateway types have configurable scale units and supported limits. The situation calls for evidence that a permitted remote user establishes a client tunnel and reaches the assigned resource route.

That observation would primarily validate another control: use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model. Virtual WAN supports specific managed NVA integrations and partner deployment requirements. The situation calls for evidence that a permitted remote user establishes a client tunnel and reaches the assigned resource route.

Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. However, the option would implement enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings; the scenario instead requires configure an Application Gateway redirect configuration associated with the right listener or rule. The differentiating evidence is that a client requesting the old path receives the correct redirect status and destination URL.

Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. However, the option would implement attach a supported Application Gateway WAF policy in the intended enforcement mode; the scenario instead requires configure an Application Gateway redirect configuration associated with the right listener or rule. The differentiating evidence is that a client requesting the old path receives the correct redirect status and destination URL.

URL path maps select backend targets on HTTP path matches, with default behavior for other paths. However, the option would implement configure path-based routing rules and suitable default backend pool in Application Gateway; the scenario instead requires configure an Application Gateway redirect configuration associated with the right listener or rule. The differentiating evidence is that a client requesting the old path receives the correct redirect status and destination URL.

That observation would primarily validate another control: use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing. Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. The situation calls for evidence that queries from separated test locations resolve to the expected healthy regional endpoint under the policy.

That observation would primarily validate another control: use Gateway Load Balancer and a supported transparent NVA service-chain configuration. Gateway Load Balancer integrates compatible NVAs into traffic flow without application-layer URL routing. The situation calls for evidence that queries from separated test locations resolve to the expected healthy regional endpoint under the policy.

That observation would primarily validate another control: configure an eligible health probe and backend listener that match the service port and NSG rules. Load Balancer health probes decide which backends are eligible for new flows. The situation calls for evidence that queries from separated test locations resolve to the expected healthy regional endpoint under the policy.

Gateway SKUs have deployment and capacity requirements that must be met by the dedicated reserved subnet. However, the option would implement resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU; the scenario instead requires design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. The differentiating evidence is that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

Active-active VPN gateway instances can provide redundant tunnel paths when peer devices support the design. However, the option would implement configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints; the scenario instead requires design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. The differentiating evidence is that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

Gateway transit makes the shared hub VPN connection available to eligible peered spokes. However, the option would implement enable hub gateway transit and compatible remote-gateway peering usage on the spoke; the scenario instead requires design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. The differentiating evidence is that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

That observation would primarily validate another control: use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. The situation calls for evidence that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

That observation would primarily validate another control: approve the required private endpoint connection and verify the origin's private link health. Private Link origin connectivity requires accepted connection state and valid private endpoint/DNS behavior. The situation calls for evidence that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.