That observation would primarily validate another control: use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. The situation calls for evidence that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

That observation would primarily validate another control: approve the required private endpoint connection and verify the origin's private link health. Private Link origin connectivity requires accepted connection state and valid private endpoint/DNS behavior. The situation calls for evidence that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

That observation would primarily validate another control: enable autoregistration for the appropriate VNet link to an Azure Private DNS zone. Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. The situation calls for evidence that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

That observation would primarily validate another control: separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. Name resolution visibility is determined by private-zone linking and namespace selection. The situation calls for evidence that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

That observation would primarily validate another control: configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. Outbound endpoints and forwarding rules let Azure-resident clients resolve selected external DNS namespaces. The situation calls for evidence that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. However, the option would implement adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design; the scenario instead requires configure an eligible health probe and backend listener that match the service port and NSG rules. The differentiating evidence is that the probe reports healthy for the running service and external requests reach the backend.

Probe-driven backend health prevents new flows from being distributed to failing endpoints. However, the option would implement configure appropriate Load Balancer probe and rollout health gating for backend readiness; the scenario instead requires configure an eligible health probe and backend listener that match the service port and NSG rules. The differentiating evidence is that the probe reports healthy for the running service and external requests reach the backend.

Inbound NAT rules target specific backend machines instead of spreading a flow across a load-balanced pool. However, the option would implement create inbound NAT rules that map unique frontend ports to designated backend endpoints; the scenario instead requires configure an eligible health probe and backend listener that match the service port and NSG rules. The differentiating evidence is that the probe reports healthy for the running service and external requests reach the backend.

That observation would primarily validate another control: create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services. Gateway, Bastion, Firewall, private endpoint and application delivery components require space and specific subnet planning. The situation calls for evidence that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

That observation would primarily validate another control: create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. The situation calls for evidence that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

That observation would primarily validate another control: use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources. A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. The situation calls for evidence that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

Basic, Standard and Premium tiers have different security capabilities and capacity. However, the option would implement choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost; the scenario instead requires associate the required UDR and validate effective routes across every protected workload subnet. The differentiating evidence is that representative outbound tests from every protected subnet appear in the firewall log.

A rule allow is not sufficient when a request or response never passes the expected firewall path. However, the option would implement correlate firewall decision logs with source and destination effective routes and return connectivity; the scenario instead requires associate the required UDR and validate effective routes across every protected workload subnet. The differentiating evidence is that representative outbound tests from every protected subnet appear in the firewall log.

Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. However, the option would implement configure a DNAT rule with the intended public destination, private target and matching security controls; the scenario instead requires associate the required UDR and validate effective routes across every protected workload subnet. The differentiating evidence is that representative outbound tests from every protected subnet appear in the firewall log.

DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. However, the option would implement enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs; the scenario instead requires enable supported VNet flow logs with the intended storage and analysis configuration. The differentiating evidence is that flow records capture approved test connections and can be queried in the selected analysis destination.

Attack path analysis evaluates connected weaknesses rather than treating each network setting in isolation. However, the option would implement use Defender for Cloud attack path analysis to identify exploitable exposure chains; the scenario instead requires enable supported VNet flow logs with the intended storage and analysis configuration. The differentiating evidence is that flow records capture approved test connections and can be queried in the selected analysis destination.

VPN disconnect and gateway events require historical telemetry, not only current status views. However, the option would implement collect virtual network gateway diagnostic logs and metrics into centralized monitoring; the scenario instead requires enable supported VNet flow logs with the intended storage and analysis configuration. The differentiating evidence is that flow records capture approved test connections and can be queried in the selected analysis destination.

That observation would primarily validate another control: verify the service's VNet integration outbound route and private DNS configuration in the integration environment. The caller's own network integration and resolver path control whether it can use a private endpoint. The situation calls for evidence that the retired consumer route no longer works and active approved consumers remain connected.

That observation would primarily validate another control: check resource-specific Private Link support, subresource group IDs and regional availability before implementation. Private endpoint connectivity depends on the destination service's supported private link capabilities. The situation calls for evidence that the retired consumer route no longer works and active approved consumers remain connected.

That observation would primarily validate another control: sequence private endpoint approval, private DNS, connectivity testing and then public network restriction. Disabling the public endpoint before validating private name resolution and routes can cause an avoidable outage. The situation calls for evidence that the retired consumer route no longer works and active approved consumers remain connected.

That observation would primarily validate another control: create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points. Priority and network scope determine whether an explicit source-block rule matches before broad allows. The situation calls for evidence that a rollback restores the expected NSG action and an audit trail identifies the configuration change.

That observation would primarily validate another control: use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. Direct Internet-wide RDP exposure is unnecessary when managed private administration is available. The situation calls for evidence that a rollback restores the expected NSG action and an audit trail identifies the configuration change.

That observation would primarily validate another control: use Network Watcher connection testing and IP flow verify alongside service listener checks. A missing application log can result from network filtering or an unavailable listener; both need evidence. The situation calls for evidence that a rollback restores the expected NSG action and an audit trail identifies the configuration change.

That observation would primarily validate another control: choose the service-supported delegated subnet and remove incompatible delegation or workload placements. Subnet delegation is scoped to supported service providers and imposes placement constraints. The situation calls for evidence that the worker serves internal requests without a public NIC IP and only approved ingress endpoints are Internet reachable.

That observation would primarily validate another control: place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets. Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. The situation calls for evidence that the worker serves internal requests without a public NIC IP and only approved ingress endpoints are Internet reachable.

That observation would primarily validate another control: reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility. Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. The situation calls for evidence that the worker serves internal requests without a public NIC IP and only approved ingress endpoints are Internet reachable.

Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. However, the option would implement complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate; the scenario instead requires configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content. The differentiating evidence is that repeated public asset requests show cache hits while authenticated account responses are not cached.

A route connects domain/path matching with the origin group and forwarding behavior. However, the option would implement create specific Front Door routes matching the intended domain and path patterns to origin groups; the scenario instead requires configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content. The differentiating evidence is that repeated public asset requests show cache hits while authenticated account responses are not cached.

Edge origin health assessment should use a consistently reachable probe without costly application side effects. However, the option would implement configure an appropriate lightweight unauthenticated Front Door origin health probe path; the scenario instead requires configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content. The differentiating evidence is that repeated public asset requests show cache hits while authenticated account responses are not cached.

That observation would primarily validate another control: review effective routes and keep the explicit appliance route when inspected forced tunneling is required. A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. The situation calls for evidence that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

That observation would primarily validate another control: define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements. Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. The situation calls for evidence that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

That observation would primarily validate another control: validate symmetric request and return routes through the stateful inspection appliance. Stateful firewalls need consistent bidirectional session visibility or supported asymmetric-flow handling. The situation calls for evidence that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.