Bring-your-own-IP requires prefix validation and provisioning rather than treating any arbitrary public range as Azure owned. However, the option would implement use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs; the scenario instead requires use private backend addressing and implement egress separately through a controlled outbound path. The differentiating evidence is that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. However, the option would implement use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources; the scenario instead requires use private backend addressing and implement egress separately through a controlled outbound path. The differentiating evidence is that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires use private backend addressing and implement egress separately through a controlled outbound path. The differentiating evidence is that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

Service endpoint routing does not bypass independent NSG or resource firewall enforcement. However, the option would implement allow the intended service-tag destination and necessary outbound flow in subnet security controls; the scenario instead requires use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required. The differentiating evidence is that the branch resolves and connects through a private endpoint or its own explicitly allowed service network path.

Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. However, the option would implement use a private endpoint instead of a service endpoint for private-IP service access; the scenario instead requires use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required. The differentiating evidence is that the branch resolves and connects through a private endpoint or its own explicitly allowed service network path.

Service endpoints do not change a service FQDN into a consumer private endpoint address. However, the option would implement keep normal public service DNS and validate service endpoint route and subnet network-rule behavior; the scenario instead requires use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required. The differentiating evidence is that the branch resolves and connects through a private endpoint or its own explicitly allowed service network path.

That observation would primarily validate another control: route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS. Private endpoints can serve on-premises clients when DNS and private routing to the VNet are established. The situation calls for evidence that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

That observation would primarily validate another control: approve the intended private endpoint connection on the target resource before testing access. Some Private Link connections require resource-owner approval before private traffic is accepted. The situation calls for evidence that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

That observation would primarily validate another control: publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints. Private Link service exposes a provider-hosted private service to consumer private endpoints. The situation calls for evidence that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

Targeted tuning preserves the broader managed rule set while addressing a justified false positive. However, the option would implement apply a narrowly scoped WAF exclusion or supported per-rule override instead of disabling all protection; the scenario instead requires review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence. The differentiating evidence is that the payment use case succeeds and approved safe attack tests still trigger expected protection.

Prevention mode can block matching HTTP requests, while detection mode is nonblocking. However, the option would implement change the tuned WAF policy to prevention mode and confirm the intended managed rule action; the scenario instead requires review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence. The differentiating evidence is that the payment use case succeeds and approved safe attack tests still trigger expected protection.

WAF policies inspect HTTP application requests for known attack patterns rather than replacing NSG port controls. However, the option would implement attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode; the scenario instead requires review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence. The differentiating evidence is that the payment use case succeeds and approved safe attack tests still trigger expected protection.

That observation would primarily validate another control: deploy Azure Front Door with appropriate origin groups and endpoint routes. Front Door is a globally distributed application delivery service that proxies and routes HTTP(S) traffic to healthy origins. The situation calls for evidence that the hostname resolves to Front Door and an external client negotiates TLS with its correct certificate.

That observation would primarily validate another control: configure an appropriate lightweight unauthenticated Front Door origin health probe path. Edge origin health assessment should use a consistently reachable probe without costly application side effects. The situation calls for evidence that the hostname resolves to Front Door and an external client negotiates TLS with its correct certificate.

That observation would primarily validate another control: associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns. Front Door WAF evaluates incoming HTTP requests at the edge before routing to origins. The situation calls for evidence that the hostname resolves to Front Door and an external client negotiates TLS with its correct certificate.

That observation would primarily validate another control: configure Azure VPN Gateway point-to-site connectivity with an approved tunnel and client profile. Point-to-site VPN is designed for individual client devices rather than fixed network-to-network peer sites. The situation calls for evidence that connected clients receive valid pool addresses and their routes reach the targeted Azure private resources.

That observation would primarily validate another control: validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration. Always On VPN is a client-side management design with specific tunnel and infrastructure requirements. The situation calls for evidence that connected clients receive valid pool addresses and their routes reach the targeted Azure private resources.

That observation would primarily validate another control: assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. The situation calls for evidence that connected clients receive valid pool addresses and their routes reach the targeted Azure private resources.

That observation would primarily validate another control: set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection. Time-series health signals and actionable alert thresholds provide earlier detection than manual portal checks. The situation calls for evidence that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

That observation would primarily validate another control: route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. Collecting network flows is useful only if relevant logs reach an authorized searchable destination. The situation calls for evidence that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

That observation would primarily validate another control: inventory DDoS protection plan associations and protected public IP resources in governance checks. A DDoS plan or protection policy only helps resources properly associated within its supported scope. The situation calls for evidence that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

That observation would primarily validate another control: design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections. Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. The situation calls for evidence that a supported traffic flow follows the optimized path and meets measured throughput requirements.

That observation would primarily validate another control: inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. Circuit health and private peering do not guarantee a workload selects that route over more specific UDR entries. The situation calls for evidence that a supported traffic flow follows the optimized path and meets measured throughput requirements.

That observation would primarily validate another control: match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters. Private peering is a BGP arrangement and cannot establish with inconsistent peer identifiers or IP addressing. The situation calls for evidence that a supported traffic flow follows the optimized path and meets measured throughput requirements.

Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. However, the option would implement configure appropriate multi-site listeners and host-based routing rules on Application Gateway; the scenario instead requires configure path-based routing rules and suitable default backend pool in Application Gateway. The differentiating evidence is that an /api request and an unrelated path are served by the expected separate pools.

Gateway backend health uses probe settings that must match the application's listener and host expectations. However, the option would implement configure a custom Application Gateway health probe with the correct host header, protocol and probe path; the scenario instead requires configure path-based routing rules and suitable default backend pool in Application Gateway. The differentiating evidence is that an /api request and an unrelated path are served by the expected separate pools.

Rewrite rules modify supported HTTP header and URL aspects without requiring changes in every backend service. However, the option would implement configure an Application Gateway rewrite rule set matching the required request or response conditions; the scenario instead requires configure path-based routing rules and suitable default backend pool in Application Gateway. The differentiating evidence is that an /api request and an unrelated path are served by the expected separate pools.

That observation would primarily validate another control: use a Private Link service with explicit connection approval and supported provider NAT configuration. A provider Private Link service can expose eligible private load-balanced workloads to consumer subscriptions. The situation calls for evidence that a datacenter client resolves the private IP and accesses the resource over the private link path.

That observation would primarily validate another control: check resource-specific Private Link support, subresource group IDs and regional availability before implementation. Private endpoint connectivity depends on the destination service's supported private link capabilities. The situation calls for evidence that a datacenter client resolves the private IP and accesses the resource over the private link path.

That observation would primarily validate another control: sequence private endpoint approval, private DNS, connectivity testing and then public network restriction. Disabling the public endpoint before validating private name resolution and routes can cause an avoidable outage. The situation calls for evidence that a datacenter client resolves the private IP and accesses the resource over the private link path.

That observation would primarily validate another control: create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. The situation calls for evidence that new member NICs receive expected traffic treatment and a nonmember remains excluded.

That observation would primarily validate another control: associate the NSG with the actual target subnet or network interface and validate effective policy. An unattached NSG does not evaluate workload traffic merely because its resource exists. The situation calls for evidence that new member NICs receive expected traffic treatment and a nonmember remains excluded.

That observation would primarily validate another control: use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. Direct Internet-wide RDP exposure is unnecessary when managed private administration is available. The situation calls for evidence that new member NICs receive expected traffic treatment and a nonmember remains excluded.