That observation would primarily validate another control: configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. The situation calls for evidence that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

That observation would primarily validate another control: design an explicit routed transit path using an NVA or supported hub routing architecture. VNet peering is not intrinsically transitive; a route or gateway strategy is required for spoke-to-spoke transit. The situation calls for evidence that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

Managed service and FQDN tags reduce brittle static destination-IP maintenance for supported services. However, the option would implement use supported Azure Firewall FQDN tags or service-aware policy features where applicable; the scenario instead requires combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth. The differentiating evidence is that a sample denied FQDN is blocked at Azure Firewall while subnet NSG rules continue enforcing local segmentation.

FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth. The differentiating evidence is that a sample denied FQDN is blocked at Azure Firewall while subnet NSG rules continue enforcing local segmentation.

Basic, Standard and Premium tiers have different security capabilities and capacity. However, the option would implement choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost; the scenario instead requires combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth. The differentiating evidence is that a sample denied FQDN is blocked at Azure Firewall while subnet NSG rules continue enforcing local segmentation.

That observation would primarily validate another control: register eligible NIC IP configurations or supported resources in the load balancer backend pool. Load balancing applies only to members registered in its backend pool and passing health checks. The situation calls for evidence that the probe reports healthy for the running service and external requests reach the backend.

That observation would primarily validate another control: configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules. High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. The situation calls for evidence that the probe reports healthy for the running service and external requests reach the backend.

That observation would primarily validate another control: configure Traffic Manager Weighted routing across the regional endpoints. Weighted Traffic Manager policies influence DNS answer distribution across eligible healthy endpoints. The situation calls for evidence that the probe reports healthy for the running service and external requests reach the backend.

Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. However, the option would implement configure Azure Traffic Manager with the correct routing method and endpoint health checks; the scenario instead requires create an internal Azure Load Balancer with a private frontend and eligible backend pool. The differentiating evidence is that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

Inbound NAT rules target specific backend machines instead of spreading a flow across a load-balanced pool. However, the option would implement create inbound NAT rules that map unique frontend ports to designated backend endpoints; the scenario instead requires create an internal Azure Load Balancer with a private frontend and eligible backend pool. The differentiating evidence is that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

Probe-driven backend health prevents new flows from being distributed to failing endpoints. However, the option would implement configure appropriate Load Balancer probe and rollout health gating for backend readiness; the scenario instead requires create an internal Azure Load Balancer with a private frontend and eligible backend pool. The differentiating evidence is that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

Front Door rules can modify edge request handling before forwarding to origin services. However, the option would implement create Front Door rules for supported redirect or URL rewrite behavior on the matching route; the scenario instead requires use the supported Front Door purge cache operation for affected URL patterns. The differentiating evidence is that a fresh request after purge returns updated origin content rather than the old cached version.

Edge origin health assessment should use a consistently reachable probe without costly application side effects. However, the option would implement configure an appropriate lightweight unauthenticated Front Door origin health probe path; the scenario instead requires use the supported Front Door purge cache operation for affected URL patterns. The differentiating evidence is that a fresh request after purge returns updated origin content rather than the old cached version.

Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. However, the option would implement use supported Front Door rules and geographic filtering where appropriate, plus origin segregation; the scenario instead requires use the supported Front Door purge cache operation for affected URL patterns. The differentiating evidence is that a fresh request after purge returns updated origin content rather than the old cached version.

An HTTP-to-HTTPS redirect moves the client to a TLS endpoint rather than serving sensitive content over HTTP. However, the option would implement configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway; the scenario instead requires move the gateway into a supported dedicated subnet with adequate addresses for expected scaling. The differentiating evidence is that gateway deployment and scale-out succeed while backend instances remain in approved separate subnets.

Frontend TLS termination does not automatically encrypt the independent gateway-to-backend connection. However, the option would implement configure HTTPS backend settings with suitable server certificate trust and host-name handling; the scenario instead requires move the gateway into a supported dedicated subnet with adequate addresses for expected scaling. The differentiating evidence is that gateway deployment and scale-out succeed while backend instances remain in approved separate subnets.

Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. However, the option would implement add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing; the scenario instead requires move the gateway into a supported dedicated subnet with adequate addresses for expected scaling. The differentiating evidence is that gateway deployment and scale-out succeed while backend instances remain in approved separate subnets.

Security admin rules can centrally enforce network intent across managed VNet groups. However, the option would implement use Azure Virtual Network Manager security admin configurations within supported scope; the scenario instead requires apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. The differentiating evidence is that only the named approved source can open the management or database port while unapproved sources are denied.

Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. However, the option would implement inspect effective security rules and IP flow verify for the exact source, destination, protocol and port; the scenario instead requires apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. The differentiating evidence is that only the named approved source can open the management or database port while unapproved sources are denied.

An unattached NSG does not evaluate workload traffic merely because its resource exists. However, the option would implement associate the NSG with the actual target subnet or network interface and validate effective policy; the scenario instead requires apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. The differentiating evidence is that only the named approved source can open the management or database port while unapproved sources are denied.

That observation would primarily validate another control: set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection. Time-series health signals and actionable alert thresholds provide earlier detection than manual portal checks. The situation calls for evidence that the diagnostic report pinpoints the failing hop or rule and a retest passes after the targeted correction.

That observation would primarily validate another control: use Network Watcher connectivity testing and route diagnostics from a representative Azure source. Healthy connection resources do not prove application reachability across security and routing boundaries. The situation calls for evidence that the diagnostic report pinpoints the failing hop or rule and a retest passes after the targeted correction.

That observation would primarily validate another control: use Defender for Cloud attack path analysis to identify exploitable exposure chains. Attack path analysis evaluates connected weaknesses rather than treating each network setting in isolation. The situation calls for evidence that the diagnostic report pinpoints the failing hop or rule and a retest passes after the targeted correction.

That observation would primarily validate another control: use supported Azure Firewall FQDN tags or service-aware policy features where applicable. Managed service and FQDN tags reduce brittle static destination-IP maintenance for supported services. The situation calls for evidence that a sample denied FQDN is blocked at Azure Firewall while subnet NSG rules continue enforcing local segmentation.

That observation would primarily validate another control: send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. The situation calls for evidence that a sample denied FQDN is blocked at Azure Firewall while subnet NSG rules continue enforcing local segmentation.

That observation would primarily validate another control: create an Azure Firewall application rule scoped to the required FQDN and protocol. Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. The situation calls for evidence that a sample denied FQDN is blocked at Azure Firewall while subnet NSG rules continue enforcing local segmentation.

An HTTP-to-HTTPS redirect moves the client to a TLS endpoint rather than serving sensitive content over HTTP. However, the option would implement configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway; the scenario instead requires configure HTTPS backend settings with suitable server certificate trust and host-name handling. The differentiating evidence is that a gateway-origin connection negotiates TLS with the intended hostname and the backend remains healthy.

Gateway backend health uses probe settings that must match the application's listener and host expectations. However, the option would implement configure a custom Application Gateway health probe with the correct host header, protocol and probe path; the scenario instead requires configure HTTPS backend settings with suitable server certificate trust and host-name handling. The differentiating evidence is that a gateway-origin connection negotiates TLS with the intended hostname and the backend remains healthy.

HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. However, the option would implement configure an Application Gateway redirect configuration associated with the right listener or rule; the scenario instead requires configure HTTPS backend settings with suitable server certificate trust and host-name handling. The differentiating evidence is that a gateway-origin connection negotiates TLS with the intended hostname and the backend remains healthy.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires use individual approved private endpoint connections and enforce data-plane identity authorization. The differentiating evidence is that a permitted identity in an approved network succeeds and a denied identity or network cannot perform the protected operation.

A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. However, the option would implement provide separate approved private endpoints for each consumer to the shared eligible Private Link service; the scenario instead requires use individual approved private endpoint connections and enforce data-plane identity authorization. The differentiating evidence is that a permitted identity in an approved network succeeds and a denied identity or network cannot perform the protected operation.

Private endpoints can serve on-premises clients when DNS and private routing to the VNet are established. However, the option would implement route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS; the scenario instead requires use individual approved private endpoint connections and enforce data-plane identity authorization. The differentiating evidence is that a permitted identity in an approved network succeeds and a denied identity or network cannot perform the protected operation.