That observation would primarily validate another control: add the selected VNet/subnet to the target service's virtual network access rules. Service endpoint enablement alone does not grant access at the PaaS service network policy layer. The situation calls for evidence that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

That observation would primarily validate another control: keep normal public service DNS and validate service endpoint route and subnet network-rule behavior. Service endpoints do not change a service FQDN into a consumer private endpoint address. The situation calls for evidence that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

That observation would primarily validate another control: choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. The situation calls for evidence that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

That observation would primarily validate another control: use the appropriate Azure service tag for supported NSG destination restrictions. Azure service tags abstract changing Azure service address ranges in network security rules. The situation calls for evidence that authorized staff connect by the approved management path and open Internet RDP tests are denied.

That observation would primarily validate another control: use Azure Virtual Network Manager security admin configurations within supported scope. Security admin rules can centrally enforce network intent across managed VNet groups. The situation calls for evidence that authorized staff connect by the approved management path and open Internet RDP tests are denied.

That observation would primarily validate another control: configure supported private endpoint network-policy settings and relevant NSG rules where enabled. Private endpoint NSG and UDR enforcement depends on subnet network policy configuration. The situation calls for evidence that authorized staff connect by the approved management path and open Internet RDP tests are denied.

That observation would primarily validate another control: align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN. IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. The situation calls for evidence that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

That observation would primarily validate another control: enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. BGP distributes network prefixes across compatible VPN peers, avoiding repeated manual network updates. The situation calls for evidence that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

That observation would primarily validate another control: choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed. Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. The situation calls for evidence that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

That observation would primarily validate another control: check resource-specific Private Link support, subresource group IDs and regional availability before implementation. Private endpoint connectivity depends on the destination service's supported private link capabilities. The situation calls for evidence that the service FQDN resolves to the private endpoint IP and a client connects successfully.

That observation would primarily validate another control: publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints. Private Link service exposes a provider-hosted private service to consumer private endpoints. The situation calls for evidence that the service FQDN resolves to the private endpoint IP and a client connects successfully.

That observation would primarily validate another control: route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS. Private endpoints can serve on-premises clients when DNS and private routing to the VNet are established. The situation calls for evidence that the service FQDN resolves to the private endpoint IP and a client connects successfully.

A provider Private Link service can expose eligible private load-balanced workloads to consumer subscriptions. However, the option would implement use a Private Link service with explicit connection approval and supported provider NAT configuration; the scenario instead requires approve the intended private endpoint connection on the target resource before testing access. The differentiating evidence is that the connection status shows approved and the authorized client completes the expected service handshake.

Private endpoints do not necessarily disable a service's existing public network endpoint automatically. However, the option would implement restrict or disable the PaaS resource's public network access separately from creating its private endpoint; the scenario instead requires approve the intended private endpoint connection on the target resource before testing access. The differentiating evidence is that the connection status shows approved and the authorized client completes the expected service handshake.

Disabling the public endpoint before validating private name resolution and routes can cause an avoidable outage. However, the option would implement sequence private endpoint approval, private DNS, connectivity testing and then public network restriction; the scenario instead requires approve the intended private endpoint connection on the target resource before testing access. The differentiating evidence is that the connection status shows approved and the authorized client completes the expected service handshake.

That observation would primarily validate another control: inspect the effective-route longest-prefix match and add the proper more-specific route where supported. Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. The situation calls for evidence that the intended prefix appears on the affected NIC and a trace reaches the destination across the selected hop.

That observation would primarily validate another control: apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. Forced tunneling through an appliance requires an explicit default route from the workload subnet. The situation calls for evidence that the intended prefix appears on the affected NIC and a trace reaches the destination across the selected hop.

That observation would primarily validate another control: design an explicit routed transit path using an NVA or supported hub routing architecture. VNet peering is not intrinsically transitive; a route or gateway strategy is required for spoke-to-spoke transit. The situation calls for evidence that the intended prefix appears on the affected NIC and a trace reaches the destination across the selected hop.

Front Door is a globally distributed application delivery service that proxies and routes HTTP(S) traffic to healthy origins. However, the option would implement deploy Azure Front Door with appropriate origin groups and endpoint routes; the scenario instead requires approve the required private endpoint connection and verify the origin's private link health. The differentiating evidence is that private connection reaches approved state and a health probe becomes successful.

Front Door WAF evaluates incoming HTTP requests at the edge before routing to origins. However, the option would implement associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns; the scenario instead requires approve the required private endpoint connection and verify the origin's private link health. The differentiating evidence is that private connection reaches approved state and a health probe becomes successful.

Front Door origin selection depends on health probes and configured origin priority or weight. However, the option would implement configure Front Door origin-group health probes and suitable priority or weight settings; the scenario instead requires approve the required private endpoint connection and verify the origin's private link health. The differentiating evidence is that private connection reaches approved state and a health probe becomes successful.

That observation would primarily validate another control: use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required. A service endpoint is a VNet subnet property and does not directly make arbitrary branch source IPs part of that subnet. The situation calls for evidence that the target service accepts the specified subnet and logs show requests attributed to the allowed source network.

That observation would primarily validate another control: enable the supported service endpoint on each specific subnet that requires the Azure service network identity. Service endpoints are configured at subnet level, not automatically across an entire VNet. The situation calls for evidence that the target service accepts the specified subnet and logs show requests attributed to the allowed source network.

That observation would primarily validate another control: enable an appropriate virtual network service endpoint and allow the subnet in the service firewall. Service endpoints extend VNet identity to supported Azure services while service traffic uses the service's public endpoint. The situation calls for evidence that the target service accepts the specified subnet and logs show requests attributed to the allowed source network.

Private endpoint connectivity depends on the destination service's supported private link capabilities. However, the option would implement check resource-specific Private Link support, subresource group IDs and regional availability before implementation; the scenario instead requires restrict or disable the PaaS resource's public network access separately from creating its private endpoint. The differentiating evidence is that an external unauthorized public connection fails while the approved private client connects.

Private endpoints map a supported PaaS service into a VNet through a private network interface. However, the option would implement create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration; the scenario instead requires restrict or disable the PaaS resource's public network access separately from creating its private endpoint. The differentiating evidence is that an external unauthorized public connection fails while the approved private client connects.

Disabling the public endpoint before validating private name resolution and routes can cause an avoidable outage. However, the option would implement sequence private endpoint approval, private DNS, connectivity testing and then public network restriction; the scenario instead requires restrict or disable the PaaS resource's public network access separately from creating its private endpoint. The differentiating evidence is that an external unauthorized public connection fails while the approved private client connects.

Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. However, the option would implement configure P2S root certificate trust and issue valid client certificates from the approved CA; the scenario instead requires assign a distinct nonoverlapping P2S client address pool and republish the client configuration. The differentiating evidence is that connected clients receive valid pool addresses and their routes reach the targeted Azure private resources.

Certificate trust must be able to exclude compromised or retired client certificates. However, the option would implement revoke or deny the specific P2S client certificate by supported gateway configuration and policy; the scenario instead requires assign a distinct nonoverlapping P2S client address pool and republish the client configuration. The differentiating evidence is that connected clients receive valid pool addresses and their routes reach the targeted Azure private resources.

P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. However, the option would implement constrain client routing and enforce destination access with NSGs and identity-aware controls; the scenario instead requires assign a distinct nonoverlapping P2S client address pool and republish the client configuration. The differentiating evidence is that connected clients receive valid pool addresses and their routes reach the targeted Azure private resources.

Bring-your-own-IP requires prefix validation and provisioning rather than treating any arbitrary public range as Azure owned. However, the option would implement use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs; the scenario instead requires use private backend addressing and implement egress separately through a controlled outbound path. The differentiating evidence is that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. However, the option would implement use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources; the scenario instead requires use private backend addressing and implement egress separately through a controlled outbound path. The differentiating evidence is that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires use private backend addressing and implement egress separately through a controlled outbound path. The differentiating evidence is that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.