That observation would primarily validate another control: link the correct service-specific private DNS zone to the client VNet and verify A-record resolution. Private Link endpoint creation does not guarantee client DNS queries return the private IP. The situation calls for evidence that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

That observation would primarily validate another control: plan consistent private DNS zone links or resolver forwarding across the client VNets. Private DNS zone visibility follows VNet links and resolution architecture, not merely peering topology. The situation calls for evidence that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

That observation would primarily validate another control: require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. Connection approval separates consumer endpoint provisioning from provider authorization. The situation calls for evidence that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. However, the option would implement use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources; the scenario instead requires provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway. The differentiating evidence is that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

Azure Firewall uses a specific reserved subnet name and supported minimum capacity for deployment and scaling. However, the option would implement provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall; the scenario instead requires provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway. The differentiating evidence is that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

Bring-your-own-IP requires prefix validation and provisioning rather than treating any arbitrary public range as Azure owned. However, the option would implement use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs; the scenario instead requires provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway. The differentiating evidence is that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

Point-to-site VPN is designed for individual client devices rather than fixed network-to-network peer sites. However, the option would implement configure Azure VPN Gateway point-to-site connectivity with an approved tunnel and client profile; the scenario instead requires revoke or deny the specific P2S client certificate by supported gateway configuration and policy. The differentiating evidence is that the revoked client fails authentication while a valid approved certificate still connects.

Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. However, the option would implement assign a distinct nonoverlapping P2S client address pool and republish the client configuration; the scenario instead requires revoke or deny the specific P2S client certificate by supported gateway configuration and policy. The differentiating evidence is that the revoked client fails authentication while a valid approved certificate still connects.

P2S connection establishes reachability but private DNS lookup depends on client and gateway DNS settings. However, the option would implement provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration; the scenario instead requires revoke or deny the specific P2S client certificate by supported gateway configuration and policy. The differentiating evidence is that the revoked client fails authentication while a valid approved certificate still connects.

That observation would primarily validate another control: inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. The situation calls for evidence that a packet from the new authorized subnet is allowed while the old unintended source no longer has access.

That observation would primarily validate another control: store NSG configurations in versioned IaC and validate effective rules before and after deployment. Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. The situation calls for evidence that a packet from the new authorized subnet is allowed while the old unintended source no longer has access.

That observation would primarily validate another control: create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. The situation calls for evidence that a packet from the new authorized subnet is allowed while the old unintended source no longer has access.

That observation would primarily validate another control: change the tuned WAF policy to prevention mode and confirm the intended managed rule action. Prevention mode can block matching HTTP requests, while detection mode is nonblocking. The situation calls for evidence that a controlled burst triggers the intended policy while ordinary client traffic is permitted.

That observation would primarily validate another control: review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence. Managed rule set versions can change match behavior and should be tested against legitimate traffic. The situation calls for evidence that a controlled burst triggers the intended policy while ordinary client traffic is permitted.

That observation would primarily validate another control: deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters. NSGs enforce network transport rules and do not parse application attack payloads. The situation calls for evidence that a controlled burst triggers the intended policy while ordinary client traffic is permitted.

That observation would primarily validate another control: choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost. Basic, Standard and Premium tiers have different security capabilities and capacity. The situation calls for evidence that representative outbound tests from every protected subnet appear in the firewall log.

That observation would primarily validate another control: use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. The situation calls for evidence that representative outbound tests from every protected subnet appear in the firewall log.

That observation would primarily validate another control: deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy. Secured virtual hubs support managed firewall enforcement for connected traffic when routing is configured. The situation calls for evidence that representative outbound tests from every protected subnet appear in the firewall log.

Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. However, the option would implement configure Azure Traffic Manager with the correct routing method and endpoint health checks; the scenario instead requires create inbound NAT rules that map unique frontend ports to designated backend endpoints. The differentiating evidence is that connecting to the assigned frontend management port consistently reaches the intended backend instance.

Weighted Traffic Manager policies influence DNS answer distribution across eligible healthy endpoints. However, the option would implement configure Traffic Manager Weighted routing across the regional endpoints; the scenario instead requires create inbound NAT rules that map unique frontend ports to designated backend endpoints. The differentiating evidence is that connecting to the assigned frontend management port consistently reaches the intended backend instance.

Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. However, the option would implement configure suitable load-balancing rules including HA ports where the chosen internal design supports them; the scenario instead requires create inbound NAT rules that map unique frontend ports to designated backend endpoints. The differentiating evidence is that connecting to the assigned frontend management port consistently reaches the intended backend instance.

That observation would primarily validate another control: use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. The situation calls for evidence that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

That observation would primarily validate another control: replace blanket allows with least-privilege application and network rule collections. Central inspection is effective only if the policy meaningfully restricts destination and transport access. The situation calls for evidence that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

That observation would primarily validate another control: reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants. Azure Firewall provisioning requires its reserved subnet and adequate address capacity. The situation calls for evidence that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

Virtual WAN gateway components are service-specific; S2S VPN gateway does not terminate ExpressRoute. However, the option would implement provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits; the scenario instead requires use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model. The differentiating evidence is that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

Virtual WAN Standard supports centralized hub routing and expanded branch/VNet connectivity services. However, the option would implement deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections; the scenario instead requires use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model. The differentiating evidence is that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

Virtual WAN hub interconnect and route propagation control cross-region VNet path availability. However, the option would implement check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions; the scenario instead requires use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model. The differentiating evidence is that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

Application Gateway provides regional layer-7 routing and TLS termination for HTTP services. However, the option would implement deploy Azure Application Gateway with HTTPS listener and path-based routing rules; the scenario instead requires configure a custom Application Gateway health probe with the correct host header, protocol and probe path. The differentiating evidence is that the custom probe reports healthy and routed requests are delivered to the backend.

Frontend IP and listener bindings determine which network scope can reach each Application Gateway site. However, the option would implement configure supported internal and public frontend IP configurations and bind listeners to the intended frontend; the scenario instead requires configure a custom Application Gateway health probe with the correct host header, protocol and probe path. The differentiating evidence is that the custom probe reports healthy and routed requests are delivered to the backend.

Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. However, the option would implement enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings; the scenario instead requires configure a custom Application Gateway health probe with the correct host header, protocol and probe path. The differentiating evidence is that the custom probe reports healthy and routed requests are delivered to the backend.

That observation would primarily validate another control: review effective routes and keep the explicit appliance route when inspected forced tunneling is required. A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. The situation calls for evidence that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

That observation would primarily validate another control: deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. Centralized change definitions make route and topology deviations detectable before deployment. The situation calls for evidence that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

That observation would primarily validate another control: use Azure Route Server with a supported BGP peer to exchange routes dynamically. Route Server exchanges BGP information with compatible appliances and Azure networking instead of relying on static edits. The situation calls for evidence that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.