That observation would primarily validate another control: review effective routes and keep the explicit appliance route when inspected forced tunneling is required. A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. The situation calls for evidence that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

That observation would primarily validate another control: define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements. Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. The situation calls for evidence that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

That observation would primarily validate another control: validate symmetric request and return routes through the stateful inspection appliance. Stateful firewalls need consistent bidirectional session visibility or supported asymmetric-flow handling. The situation calls for evidence that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

Subnet delegation is scoped to supported service providers and imposes placement constraints. However, the option would implement choose the service-supported delegated subnet and remove incompatible delegation or workload placements; the scenario instead requires create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. The differentiating evidence is that an authorized administrator opens an RDP or SSH session to a private VM without assigning it a public IP.

A standalone VM public IP attachment belongs to a NIC IP configuration and a static allocation preserves its address. However, the option would implement associate a supported static public IP resource with the correct VM network interface configuration; the scenario instead requires create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. The differentiating evidence is that an authorized administrator opens an RDP or SSH session to a private VM without assigning it a public IP.

Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. However, the option would implement place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets; the scenario instead requires create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. The differentiating evidence is that an authorized administrator opens an RDP or SSH session to a private VM without assigning it a public IP.

That observation would primarily validate another control: associate a Front Door WAF policy with the intended endpoint domains through a security policy. Front Door WAF applies application-layer filtering at the Microsoft edge for protected routes. The situation calls for evidence that the protected login route enforces stronger policy while public static content stays accessible as designed.

That observation would primarily validate another control: define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers. Two WAF enforcement points can both inspect requests; policy coordination reduces conflicting false positives. The situation calls for evidence that the protected login route enforces stronger policy while public static content stays accessible as designed.

That observation would primarily validate another control: review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence. Managed rule set versions can change match behavior and should be tested against legitimate traffic. The situation calls for evidence that the protected login route enforces stronger policy while public static content stays accessible as designed.

That observation would primarily validate another control: inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls. P2S gateway SKU limits and client tunnel health are distinct from account credential validity. The situation calls for evidence that the supported Windows host establishes the expected private management path to the target VM.

That observation would primarily validate another control: constrain client routing and enforce destination access with NSGs and identity-aware controls. P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. The situation calls for evidence that the supported Windows host establishes the expected private management path to the target VM.

That observation would primarily validate another control: validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration. Always On VPN is a client-side management design with specific tunnel and infrastructure requirements. The situation calls for evidence that the supported Windows host establishes the expected private management path to the target VM.

That observation would primarily validate another control: attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet. NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. The situation calls for evidence that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

That observation would primarily validate another control: inspect peering status, route propagation and effective routes before changing security policies. Control-plane connectivity and data-plane path selection must be diagnosed separately. The situation calls for evidence that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires choose the service-supported delegated subnet and remove incompatible delegation or workload placements. The differentiating evidence is that the configured service is accepted by the subnet and deployment validation no longer reports delegation conflicts.

Reproducible network definitions and validation catch overlapping or noncompliant ranges before live peering. However, the option would implement define address and segmentation standards in IaC with governance checks before production deployment; the scenario instead requires choose the service-supported delegated subnet and remove incompatible delegation or workload placements. The differentiating evidence is that the configured service is accepted by the subnet and deployment validation no longer reports delegation conflicts.

Peering and hybrid routing require unambiguous destinations; overlapping prefixes prevent intended reachability. However, the option would implement allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity; the scenario instead requires choose the service-supported delegated subnet and remove incompatible delegation or workload placements. The differentiating evidence is that the configured service is accepted by the subnet and deployment validation no longer reports delegation conflicts.

A standalone policy object does not inspect traffic until attached to an applicable gateway scope. However, the option would implement associate the WAF policy to the intended Application Gateway scope, listener or route as supported; the scenario instead requires review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence. The differentiating evidence is that the payment use case succeeds and approved safe attack tests still trigger expected protection.

Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. However, the option would implement use WAF diagnostic logs to identify matched policy, rule and client/request details; the scenario instead requires review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence. The differentiating evidence is that the payment use case succeeds and approved safe attack tests still trigger expected protection.

Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. However, the option would implement start the WAF in detection mode, review matched rules and then enable prevention after tuning; the scenario instead requires review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence. The differentiating evidence is that the payment use case succeeds and approved safe attack tests still trigger expected protection.

That observation would primarily validate another control: use Network Watcher IP flow verify or effective security rules for the exact source/destination tuple. Effective NSG evaluation identifies the allow or deny rule governing a specific flow. The situation calls for evidence that the view shows a time-aligned degradation on the affected connection and recovery after the fix.

That observation would primarily validate another control: review Defender for Cloud Secure Score security recommendations for network resources. Secure Score recommendations expose actionable posture findings to prioritize weak network configurations. The situation calls for evidence that the view shows a time-aligned degradation on the affected connection and recovery after the fix.

That observation would primarily validate another control: route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. Collecting network flows is useful only if relevant logs reach an authorized searchable destination. The situation calls for evidence that the view shows a time-aligned degradation on the affected connection and recovery after the fix.

That observation would primarily validate another control: configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination. Network rules are appropriate for transport and IP-address traffic that is not evaluated as HTTP hostnames. The situation calls for evidence that the firewall provisions successfully and its health and data-plane traffic meet deployment checks.

That observation would primarily validate another control: select Azure Firewall Premium and configure supported TLS inspection and IDPS settings. Advanced IDPS and TLS inspection are Premium capabilities and require certificate and policy planning. The situation calls for evidence that the firewall provisions successfully and its health and data-plane traffic meet deployment checks.

That observation would primarily validate another control: use supported Azure Firewall FQDN tags or service-aware policy features where applicable. Managed service and FQDN tags reduce brittle static destination-IP maintenance for supported services. The situation calls for evidence that the firewall provisions successfully and its health and data-plane traffic meet deployment checks.

Application Gateway has subnet placement and IP capacity requirements distinct from backend pools. However, the option would implement move the gateway into a supported dedicated subnet with adequate addresses for expected scaling; the scenario instead requires deploy Azure Application Gateway with HTTPS listener and path-based routing rules. The differentiating evidence is that requests to each URL path reach the intended healthy backend with a valid TLS response.

Frontend TLS termination does not automatically encrypt the independent gateway-to-backend connection. However, the option would implement configure HTTPS backend settings with suitable server certificate trust and host-name handling; the scenario instead requires deploy Azure Application Gateway with HTTPS listener and path-based routing rules. The differentiating evidence is that requests to each URL path reach the intended healthy backend with a valid TLS response.

HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. However, the option would implement configure an Application Gateway redirect configuration associated with the right listener or rule; the scenario instead requires deploy Azure Application Gateway with HTTPS listener and path-based routing rules. The differentiating evidence is that requests to each URL path reach the intended healthy backend with a valid TLS response.

That observation would primarily validate another control: configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. The situation calls for evidence that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

That observation would primarily validate another control: design an explicit routed transit path using an NVA or supported hub routing architecture. VNet peering is not intrinsically transitive; a route or gateway strategy is required for spoke-to-spoke transit. The situation calls for evidence that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.