That observation would primarily validate another control: assign a distinct nonoverlapping P2S client address pool and republish the client configuration. Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. The situation calls for evidence that a permitted user signs in with the intended Entra policy and a rejected identity fails access.

That observation would primarily validate another control: configure P2S root certificate trust and issue valid client certificates from the approved CA. Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. The situation calls for evidence that a permitted user signs in with the intended Entra policy and a rejected identity fails access.

That observation would primarily validate another control: provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration. P2S connection establishes reachability but private DNS lookup depends on client and gateway DNS settings. The situation calls for evidence that a permitted user signs in with the intended Entra policy and a rejected identity fails access.

That observation would primarily validate another control: deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters. NSGs enforce network transport rules and do not parse application attack payloads. The situation calls for evidence that approved test requests produce WAF logs in detection and are appropriately blocked in prevention after tuning.

That observation would primarily validate another control: configure supported WAF rate-limit or bot protection rules at the appropriate edge scope. WAF custom rate limits and bot controls can mitigate application-layer request floods when correctly scoped. The situation calls for evidence that approved test requests produce WAF logs in detection and are appropriately blocked in prevention after tuning.

That observation would primarily validate another control: scope and associate appropriate WAF security policies to supported domains or path patterns. WAF policy association and custom rule match conditions determine where application-layer controls apply. The situation calls for evidence that approved test requests produce WAF logs in detection and are appropriately blocked in prevention after tuning.

That observation would primarily validate another control: create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. Private endpoints map a supported PaaS service into a VNet through a private network interface. The situation calls for evidence that a representative approved flow reaches the endpoint through the intended path and denied flows are blocked.

That observation would primarily validate another control: provide separate approved private endpoints for each consumer to the shared eligible Private Link service. A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. The situation calls for evidence that a representative approved flow reaches the endpoint through the intended path and denied flows are blocked.

That observation would primarily validate another control: require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. Connection approval separates consumer endpoint provisioning from provider authorization. The situation calls for evidence that a representative approved flow reaches the endpoint through the intended path and denied flows are blocked.

Performance routing maps DNS clients to suitable regional endpoints using the Traffic Manager performance model. However, the option would implement use Traffic Manager Performance routing with enabled healthy endpoints; the scenario instead requires register eligible NIC IP configurations or supported resources in the load balancer backend pool. The differentiating evidence is that both registered healthy instances receive requests under an observed distribution sample.

Gateway Load Balancer integrates compatible NVAs into traffic flow without application-layer URL routing. However, the option would implement use Gateway Load Balancer and a supported transparent NVA service-chain configuration; the scenario instead requires register eligible NIC IP configurations or supported resources in the load balancer backend pool. The differentiating evidence is that both registered healthy instances receive requests under an observed distribution sample.

Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. However, the option would implement configure suitable load-balancing rules including HA ports where the chosen internal design supports them; the scenario instead requires register eligible NIC IP configurations or supported resources in the load balancer backend pool. The differentiating evidence is that both registered healthy instances receive requests under an observed distribution sample.

New NSG flow logs are no longer supported; VNet flow logs are the recommended replacement. However, the option would implement enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment; the scenario instead requires match NSG rules to the effective private source and destination packet addresses at the NIC boundary. The differentiating evidence is that iP flow verify reports the intended private-address rule and the internal application test passes.

A missing application log can result from network filtering or an unavailable listener; both need evidence. However, the option would implement use Network Watcher connection testing and IP flow verify alongside service listener checks; the scenario instead requires match NSG rules to the effective private source and destination packet addresses at the NIC boundary. The differentiating evidence is that iP flow verify reports the intended private-address rule and the internal application test passes.

An unattached NSG does not evaluate workload traffic merely because its resource exists. However, the option would implement associate the NSG with the actual target subnet or network interface and validate effective policy; the scenario instead requires match NSG rules to the effective private source and destination packet addresses at the NIC boundary. The differentiating evidence is that iP flow verify reports the intended private-address rule and the internal application test passes.

Gateway backend health uses probe settings that must match the application's listener and host expectations. However, the option would implement configure a custom Application Gateway health probe with the correct host header, protocol and probe path; the scenario instead requires configure HTTPS backend settings with suitable server certificate trust and host-name handling. The differentiating evidence is that a gateway-origin connection negotiates TLS with the intended hostname and the backend remains healthy.

Layer-7 backend routing and TLS validation depend on the host and protocol settings. However, the option would implement align Application Gateway backend host-name and health-probe configuration with the origin virtual host; the scenario instead requires configure HTTPS backend settings with suitable server certificate trust and host-name handling. The differentiating evidence is that a gateway-origin connection negotiates TLS with the intended hostname and the backend remains healthy.

Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. However, the option would implement enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings; the scenario instead requires configure HTTPS backend settings with suitable server certificate trust and host-name handling. The differentiating evidence is that a gateway-origin connection negotiates TLS with the intended hostname and the backend remains healthy.

Service endpoint enablement alone does not grant access at the PaaS service network policy layer. However, the option would implement add the selected VNet/subnet to the target service's virtual network access rules; the scenario instead requires review service endpoint behavior and update the target service's VNet network rules rather than relying only on public egress IPs. The differentiating evidence is that the target service accepts the specified subnet and logs show requests attributed to the allowed source network.

A service endpoint is a VNet subnet property and does not directly make arbitrary branch source IPs part of that subnet. However, the option would implement use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required; the scenario instead requires review service endpoint behavior and update the target service's VNet network rules rather than relying only on public egress IPs. The differentiating evidence is that the target service accepts the specified subnet and logs show requests attributed to the allowed source network.

Network allow lists and data-plane authorization are independent controls. However, the option would implement combine service endpoint network rules with proper service authentication and RBAC or access policies; the scenario instead requires review service endpoint behavior and update the target service's VNet network rules rather than relying only on public egress IPs. The differentiating evidence is that the target service accepts the specified subnet and logs show requests attributed to the allowed source network.

That observation would primarily validate another control: replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. The situation calls for evidence that requests to each URL path reach the intended healthy backend with a valid TLS response.

That observation would primarily validate another control: enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. The situation calls for evidence that requests to each URL path reach the intended healthy backend with a valid TLS response.

That observation would primarily validate another control: configure an Application Gateway redirect configuration associated with the right listener or rule. HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. The situation calls for evidence that requests to each URL path reach the intended healthy backend with a valid TLS response.

Hierarchical policies provide centralized baselines while allowing controlled local additions. However, the option would implement use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies; the scenario instead requires replace blanket allows with least-privilege application and network rule collections. The differentiating evidence is that authorized dependencies remain functional while representative prohibited destinations are denied.

A rule allow is not sufficient when a request or response never passes the expected firewall path. However, the option would implement correlate firewall decision logs with source and destination effective routes and return connectivity; the scenario instead requires replace blanket allows with least-privilege application and network rule collections. The differentiating evidence is that authorized dependencies remain functional while representative prohibited destinations are denied.

Network rules are appropriate for transport and IP-address traffic that is not evaluated as HTTP hostnames. However, the option would implement configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination; the scenario instead requires replace blanket allows with least-privilege application and network rule collections. The differentiating evidence is that authorized dependencies remain functional while representative prohibited destinations are denied.

Network rules are appropriate for transport and IP-address traffic that is not evaluated as HTTP hostnames. However, the option would implement configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination; the scenario instead requires choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost. The differentiating evidence is that selected firewall tier supports required rules and monitored traffic stays within capacity.

Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. However, the option would implement use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance; the scenario instead requires choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost. The differentiating evidence is that selected firewall tier supports required rules and monitored traffic stays within capacity.

Azure Firewall provisioning requires its reserved subnet and adequate address capacity. However, the option would implement reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants; the scenario instead requires choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost. The differentiating evidence is that selected firewall tier supports required rules and monitored traffic stays within capacity.

Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. However, the option would implement assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply; the scenario instead requires update the local network gateway resource with the remote VPN device public IP and correct prefixes. The differentiating evidence is that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

Gateway SKUs have deployment and capacity requirements that must be met by the dedicated reserved subnet. However, the option would implement resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU; the scenario instead requires update the local network gateway resource with the remote VPN device public IP and correct prefixes. The differentiating evidence is that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. However, the option would implement deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device; the scenario instead requires update the local network gateway resource with the remote VPN device public IP and correct prefixes. The differentiating evidence is that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.