That observation would primarily validate another control: review effective routes and keep the explicit appliance route when inspected forced tunneling is required. A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. The situation calls for evidence that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

That observation would primarily validate another control: deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. Centralized change definitions make route and topology deviations detectable before deployment. The situation calls for evidence that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

That observation would primarily validate another control: use Azure Route Server with a supported BGP peer to exchange routes dynamically. Route Server exchanges BGP information with compatible appliances and Azure networking instead of relying on static edits. The situation calls for evidence that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

That observation would primarily validate another control: keep normal public service DNS and validate service endpoint route and subnet network-rule behavior. Service endpoints do not change a service FQDN into a consumer private endpoint address. The situation calls for evidence that the client resolves to a private endpoint IP and public service network access is disabled.

That observation would primarily validate another control: add the selected VNet/subnet to the target service's virtual network access rules. Service endpoint enablement alone does not grant access at the PaaS service network policy layer. The situation calls for evidence that the client resolves to a private endpoint IP and public service network access is disabled.

That observation would primarily validate another control: allow the intended service-tag destination and necessary outbound flow in subnet security controls. Service endpoint routing does not bypass independent NSG or resource firewall enforcement. The situation calls for evidence that the client resolves to a private endpoint IP and public service network access is disabled.

That observation would primarily validate another control: replace blanket allows with least-privilege application and network rule collections. Central inspection is effective only if the policy meaningfully restricts destination and transport access. The situation calls for evidence that an approved test deny yields a searchable event with source, destination and matching policy details.

That observation would primarily validate another control: use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. Hierarchical policies provide centralized baselines while allowing controlled local additions. The situation calls for evidence that an approved test deny yields a searchable event with source, destination and matching policy details.

That observation would primarily validate another control: deploy Azure Firewall into a supported hub and route workload egress through its private IP. Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. The situation calls for evidence that an approved test deny yields a searchable event with source, destination and matching policy details.

That observation would primarily validate another control: create an internal Azure Load Balancer with a private frontend and eligible backend pool. Azure Load Balancer distributes layer-4 traffic to backend endpoints while an internal frontend stays private. The situation calls for evidence that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

That observation would primarily validate another control: register eligible NIC IP configurations or supported resources in the load balancer backend pool. Load balancing applies only to members registered in its backend pool and passing health checks. The situation calls for evidence that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

That observation would primarily validate another control: adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. The situation calls for evidence that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

That observation would primarily validate another control: respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. The situation calls for evidence that a test from a permitted hub path succeeds while a prohibited direct spoke-to-spoke path is absent.

That observation would primarily validate another control: inspect peering status, route propagation and effective routes before changing security policies. Control-plane connectivity and data-plane path selection must be diagnosed separately. The situation calls for evidence that a test from a permitted hub path succeeds while a prohibited direct spoke-to-spoke path is absent.

That observation would primarily validate another control: attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet. NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. The situation calls for evidence that a test from a permitted hub path succeeds while a prohibited direct spoke-to-spoke path is absent.

Gateway transit makes the shared hub VPN connection available to eligible peered spokes. However, the option would implement enable hub gateway transit and compatible remote-gateway peering usage on the spoke; the scenario instead requires align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN. The differentiating evidence is that iKE negotiation succeeds and protected test packets traverse the established IPsec security association.

Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. However, the option would implement update the local network gateway resource with the remote VPN device public IP and correct prefixes; the scenario instead requires align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN. The differentiating evidence is that iKE negotiation succeeds and protected test packets traverse the established IPsec security association.

Internet-bound branch traffic requires explicit default-route propagation and a compatible secured hub path. However, the option would implement design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing; the scenario instead requires align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN. The differentiating evidence is that iKE negotiation succeeds and protected test packets traverse the established IPsec security association.

VPN authentication alone does not install all required routes to remote interconnected networks. However, the option would implement review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes; the scenario instead requires regenerate and distribute the appropriate Azure VPN client configuration profile after gateway changes. The differentiating evidence is that a freshly configured client imports the new profile and reaches the expected VNet resources.

Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. However, the option would implement configure P2S root certificate trust and issue valid client certificates from the approved CA; the scenario instead requires regenerate and distribute the appropriate Azure VPN client configuration profile after gateway changes. The differentiating evidence is that a freshly configured client imports the new profile and reaches the expected VNet resources.

Certificate trust must be able to exclude compromised or retired client certificates. However, the option would implement revoke or deny the specific P2S client certificate by supported gateway configuration and policy; the scenario instead requires regenerate and distribute the appropriate Azure VPN client configuration profile after gateway changes. The differentiating evidence is that a freshly configured client imports the new profile and reaches the expected VNet resources.

That observation would primarily validate another control: add the selected VNet/subnet to the target service's virtual network access rules. Service endpoint enablement alone does not grant access at the PaaS service network policy layer. The situation calls for evidence that dNS retains expected public service records while approved subnet access succeeds under the service firewall.

That observation would primarily validate another control: allow the intended service-tag destination and necessary outbound flow in subnet security controls. Service endpoint routing does not bypass independent NSG or resource firewall enforcement. The situation calls for evidence that dNS retains expected public service records while approved subnet access succeeds under the service firewall.

That observation would primarily validate another control: enable the supported service endpoint on each specific subnet that requires the Azure service network identity. Service endpoints are configured at subnet level, not automatically across an entire VNet. The situation calls for evidence that dNS retains expected public service records while approved subnet access succeeds under the service firewall.

That observation would primarily validate another control: deploy Azure Firewall into a supported hub and route workload egress through its private IP. Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. The situation calls for evidence that branch and spoke test egress follows the hub firewall and obeys the intended application rule.

That observation would primarily validate another control: combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth. NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. The situation calls for evidence that branch and spoke test egress follows the hub firewall and obeys the intended application rule.

That observation would primarily validate another control: replace blanket allows with least-privilege application and network rule collections. Central inspection is effective only if the policy meaningfully restricts destination and transport access. The situation calls for evidence that branch and spoke test egress follows the hub firewall and obeys the intended application rule.

That observation would primarily validate another control: restrict or disable the PaaS resource's public network access separately from creating its private endpoint. Private endpoints do not necessarily disable a service's existing public network endpoint automatically. The situation calls for evidence that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

That observation would primarily validate another control: create the needed private endpoints and matching DNS zones for each required supported storage subresource. Private Link for multi-service resources may have different endpoint group IDs and DNS zones. The situation calls for evidence that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

That observation would primarily validate another control: route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS. Private endpoints can serve on-premises clients when DNS and private routing to the VNet are established. The situation calls for evidence that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

That observation would primarily validate another control: place Front Door in front of appropriate regional origin gateways with correct host headers and probes. Front Door provides global entry and acceleration, while regional gateways retain local layer-7 capabilities. The situation calls for evidence that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

That observation would primarily validate another control: apply supported origin access restrictions using Front Door identification and approved security controls. Public origins need defenses against clients bypassing edge WAF and delivery rules. The situation calls for evidence that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

That observation would primarily validate another control: use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. The situation calls for evidence that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.