Two WAF enforcement points can both inspect requests; policy coordination reduces conflicting false positives. However, the option would implement define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers; the scenario instead requires change the tuned WAF policy to prevention mode and confirm the intended managed rule action. The differentiating evidence is that the safe test produces the expected block status and origin logs show no delivered malicious request.

Managed rule set versions can change match behavior and should be tested against legitimate traffic. However, the option would implement review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence; the scenario instead requires change the tuned WAF policy to prevention mode and confirm the intended managed rule action. The differentiating evidence is that the safe test produces the expected block status and origin logs show no delivered malicious request.

Front Door WAF applies application-layer filtering at the Microsoft edge for protected routes. However, the option would implement associate a Front Door WAF policy with the intended endpoint domains through a security policy; the scenario instead requires change the tuned WAF policy to prevention mode and confirm the intended managed rule action. The differentiating evidence is that the safe test produces the expected block status and origin logs show no delivered malicious request.

Hierarchical policies provide centralized baselines while allowing controlled local additions. However, the option would implement use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies; the scenario instead requires send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. The differentiating evidence is that an approved test deny yields a searchable event with source, destination and matching policy details.

NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. However, the option would implement combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth; the scenario instead requires send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. The differentiating evidence is that an approved test deny yields a searchable event with source, destination and matching policy details.

FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. The differentiating evidence is that an approved test deny yields a searchable event with source, destination and matching policy details.

A rule allow is not sufficient when a request or response never passes the expected firewall path. However, the option would implement correlate firewall decision logs with source and destination effective routes and return connectivity; the scenario instead requires configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination. The differentiating evidence is that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination. The differentiating evidence is that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

Azure Firewall cannot inspect flows that routing directs around its data path. However, the option would implement associate the required UDR and validate effective routes across every protected workload subnet; the scenario instead requires configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination. The differentiating evidence is that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

That observation would primarily validate another control: create inbound NAT rules that map unique frontend ports to designated backend endpoints. Inbound NAT rules target specific backend machines instead of spreading a flow across a load-balanced pool. The situation calls for evidence that a statistically meaningful set of test DNS answers reflects the configured relative weights.

That observation would primarily validate another control: use Traffic Manager Performance routing with enabled healthy endpoints. Performance routing maps DNS clients to suitable regional endpoints using the Traffic Manager performance model. The situation calls for evidence that a statistically meaningful set of test DNS answers reflects the configured relative weights.

That observation would primarily validate another control: configure Azure Traffic Manager with the correct routing method and endpoint health checks. Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. The situation calls for evidence that a statistically meaningful set of test DNS answers reflects the configured relative weights.

That observation would primarily validate another control: use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. Direct Internet-wide RDP exposure is unnecessary when managed private administration is available. The situation calls for evidence that the target NIC shows expected effective rules and an authorized allow/deny test confirms enforcement.

That observation would primarily validate another control: inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. The situation calls for evidence that the target NIC shows expected effective rules and an authorized allow/deny test confirms enforcement.

That observation would primarily validate another control: configure supported private endpoint network-policy settings and relevant NSG rules where enabled. Private endpoint NSG and UDR enforcement depends on subnet network policy configuration. The situation calls for evidence that the target NIC shows expected effective rules and an authorized allow/deny test confirms enforcement.

That observation would primarily validate another control: create purpose-specific subnets in the VNet and apply matching network security and routing controls. VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. The situation calls for evidence that the worker serves internal requests without a public NIC IP and only approved ingress endpoints are Internet reachable.

That observation would primarily validate another control: create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. The situation calls for evidence that the worker serves internal requests without a public NIC IP and only approved ingress endpoints are Internet reachable.

That observation would primarily validate another control: create an eligible dedicated subnet and apply the delegation required by the integrating Azure service. Some platform integrations require subnet delegation and cannot coexist with arbitrary resources in that subnet. The situation calls for evidence that the worker serves internal requests without a public NIC IP and only approved ingress endpoints are Internet reachable.

That observation would primarily validate another control: configure Azure Traffic Manager with the correct routing method and endpoint health checks. Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. The situation calls for evidence that both registered healthy instances receive requests under an observed distribution sample.

That observation would primarily validate another control: configure an eligible health probe and backend listener that match the service port and NSG rules. Load Balancer health probes decide which backends are eligible for new flows. The situation calls for evidence that both registered healthy instances receive requests under an observed distribution sample.

That observation would primarily validate another control: use Traffic Manager Performance routing with enabled healthy endpoints. Performance routing maps DNS clients to suitable regional endpoints using the Traffic Manager performance model. The situation calls for evidence that both registered healthy instances receive requests under an observed distribution sample.

Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. However, the option would implement choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing; the scenario instead requires keep normal public service DNS and validate service endpoint route and subnet network-rule behavior. The differentiating evidence is that dNS retains expected public service records while approved subnet access succeeds under the service firewall.

Network allow lists and data-plane authorization are independent controls. However, the option would implement combine service endpoint network rules with proper service authentication and RBAC or access policies; the scenario instead requires keep normal public service DNS and validate service endpoint route and subnet network-rule behavior. The differentiating evidence is that dNS retains expected public service records while approved subnet access succeeds under the service firewall.

Service endpoint routing does not bypass independent NSG or resource firewall enforcement. However, the option would implement allow the intended service-tag destination and necessary outbound flow in subnet security controls; the scenario instead requires keep normal public service DNS and validate service endpoint route and subnet network-rule behavior. The differentiating evidence is that dNS retains expected public service records while approved subnet access succeeds under the service firewall.

Point-to-site VPN is designed for individual client devices rather than fixed network-to-network peer sites. However, the option would implement configure Azure VPN Gateway point-to-site connectivity with an approved tunnel and client profile; the scenario instead requires provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration. The differentiating evidence is that the VPN client resolves the intended internal name privately and connects using that address.

Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. However, the option would implement assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment; the scenario instead requires provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration. The differentiating evidence is that the VPN client resolves the intended internal name privately and connects using that address.

P2S tunnel protocol support varies by gateway settings and VPN client platform. However, the option would implement choose a gateway-supported tunnel type compatible with the target operating systems and approved client software; the scenario instead requires provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration. The differentiating evidence is that the VPN client resolves the intended internal name privately and connects using that address.

Active-active VPN gateway instances can provide redundant tunnel paths when peer devices support the design. However, the option would implement configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints; the scenario instead requires choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed. The differentiating evidence is that negotiation completes with matching selectors and the configured on-premises network prefixes are reachable.

Internet-bound branch traffic requires explicit default-route propagation and a compatible secured hub path. However, the option would implement design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing; the scenario instead requires choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed. The differentiating evidence is that negotiation completes with matching selectors and the configured on-premises network prefixes are reachable.

IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. However, the option would implement align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN; the scenario instead requires choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed. The differentiating evidence is that negotiation completes with matching selectors and the configured on-premises network prefixes are reachable.

That observation would primarily validate another control: link the correct service-specific private DNS zone to the client VNet and verify A-record resolution. Private Link endpoint creation does not guarantee client DNS queries return the private IP. The situation calls for evidence that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

That observation would primarily validate another control: plan consistent private DNS zone links or resolver forwarding across the client VNets. Private DNS zone visibility follows VNet links and resolution architecture, not merely peering topology. The situation calls for evidence that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

That observation would primarily validate another control: require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. Connection approval separates consumer endpoint provisioning from provider authorization. The situation calls for evidence that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.