That observation would primarily validate another control: design Virtual WAN traffic security explicitly with compatible firewall and routing features. Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. The situation calls for evidence that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

That observation would primarily validate another control: deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings. Virtual hubs need relevant gateways to terminate the actual connection type. The situation calls for evidence that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

That observation would primarily validate another control: deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. The situation calls for evidence that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

That observation would primarily validate another control: create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. The situation calls for evidence that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

That observation would primarily validate another control: allocate a Public IP Prefix and create supported public IP resources from that prefix. Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. The situation calls for evidence that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

That observation would primarily validate another control: allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity. Peering and hybrid routing require unambiguous destinations; overlapping prefixes prevent intended reachability. The situation calls for evidence that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

That observation would primarily validate another control: use Azure Virtual Network Manager security admin configurations within supported scope. Security admin rules can centrally enforce network intent across managed VNet groups. The situation calls for evidence that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

That observation would primarily validate another control: use Network Watcher connection testing and IP flow verify alongside service listener checks. A missing application log can result from network filtering or an unavailable listener; both need evidence. The situation calls for evidence that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

That observation would primarily validate another control: enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment. New NSG flow logs are no longer supported; VNet flow logs are the recommended replacement. The situation calls for evidence that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

The inbound endpoint accepts hybrid DNS queries and can resolve private zones linked to its VNet. However, the option would implement deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP; the scenario instead requires create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. The differentiating evidence is that a query to public recursive resolvers returns the delegated Azure DNS answer for the test hostname.

Ruleset links determine which VNets apply the conditional forwarding rules; peering alone is insufficient. However, the option would implement link the intended spoke VNet to the appropriate DNS forwarding ruleset; the scenario instead requires create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. The differentiating evidence is that a query to public recursive resolvers returns the delegated Azure DNS answer for the test hostname.

DNS caching can delay a record change independently of network route availability. However, the option would implement reduce record TTL before a planned migration and validate propagation and client cache expiry; the scenario instead requires create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. The differentiating evidence is that a query to public recursive resolvers returns the delegated Azure DNS answer for the test hostname.

Priority and network scope determine whether an explicit source-block rule matches before broad allows. However, the option would implement create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points; the scenario instead requires store NSG configurations in versioned IaC and validate effective rules before and after deployment. The differentiating evidence is that a rollback restores the expected NSG action and an audit trail identifies the configuration change.

New NSG flow logs are no longer supported; VNet flow logs are the recommended replacement. However, the option would implement enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment; the scenario instead requires store NSG configurations in versioned IaC and validate effective rules before and after deployment. The differentiating evidence is that a rollback restores the expected NSG action and an audit trail identifies the configuration change.

Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. However, the option would implement create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route; the scenario instead requires store NSG configurations in versioned IaC and validate effective rules before and after deployment. The differentiating evidence is that a rollback restores the expected NSG action and an audit trail identifies the configuration change.

A missing application log can result from network filtering or an unavailable listener; both need evidence. However, the option would implement use Network Watcher connection testing and IP flow verify alongside service listener checks; the scenario instead requires enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment. The differentiating evidence is that a test east-west flow produces the expected VNet flow record in the selected log destination.

IP-prefix and application security group membership determine which NSG rules match relocated workloads. However, the option would implement update NSG source or ASG membership for the new workload placement after validating its identity; the scenario instead requires enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment. The differentiating evidence is that a test east-west flow produces the expected VNet flow record in the selected log destination.

Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. However, the option would implement store NSG configurations in versioned IaC and validate effective rules before and after deployment; the scenario instead requires enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment. The differentiating evidence is that a test east-west flow produces the expected VNet flow record in the selected log destination.

WAF policy association and custom rule match conditions determine where application-layer controls apply. However, the option would implement scope and associate appropriate WAF security policies to supported domains or path patterns; the scenario instead requires associate the WAF policy to the intended Application Gateway scope, listener or route as supported. The differentiating evidence is that the frontend shows the active policy association and a representative managed-rule test is logged.

Managed rule set versions can change match behavior and should be tested against legitimate traffic. However, the option would implement review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence; the scenario instead requires associate the WAF policy to the intended Application Gateway scope, listener or route as supported. The differentiating evidence is that the frontend shows the active policy association and a representative managed-rule test is logged.

WAF custom rate limits and bot controls can mitigate application-layer request floods when correctly scoped. However, the option would implement configure supported WAF rate-limit or bot protection rules at the appropriate edge scope; the scenario instead requires associate the WAF policy to the intended Application Gateway scope, listener or route as supported. The differentiating evidence is that the frontend shows the active policy association and a representative managed-rule test is logged.

That observation would primarily validate another control: use Defender for Cloud Cloud Security Explorer to query related security posture resources. Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. The situation calls for evidence that the diagnostic report pinpoints the failing hop or rule and a retest passes after the targeted correction.

That observation would primarily validate another control: enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs. DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. The situation calls for evidence that the diagnostic report pinpoints the failing hop or rule and a retest passes after the targeted correction.

That observation would primarily validate another control: route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. Collecting network flows is useful only if relevant logs reach an authorized searchable destination. The situation calls for evidence that the diagnostic report pinpoints the failing hop or rule and a retest passes after the targeted correction.

That observation would primarily validate another control: replace blanket allows with least-privilege application and network rule collections. Central inspection is effective only if the policy meaningfully restricts destination and transport access. The situation calls for evidence that an approved safe detection sample produces an IDPS event and permitted TLS traffic is inspected without certificate errors.

That observation would primarily validate another control: use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. Hierarchical policies provide centralized baselines while allowing controlled local additions. The situation calls for evidence that an approved safe detection sample produces an IDPS event and permitted TLS traffic is inspected without certificate errors.

That observation would primarily validate another control: create an Azure Firewall application rule scoped to the required FQDN and protocol. Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. The situation calls for evidence that an approved safe detection sample produces an IDPS event and permitted TLS traffic is inspected without certificate errors.

Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. However, the option would implement use WAF diagnostic logs to identify matched policy, rule and client/request details; the scenario instead requires associate the WAF policy to the intended Application Gateway scope, listener or route as supported. The differentiating evidence is that the frontend shows the active policy association and a representative managed-rule test is logged.

Two WAF enforcement points can both inspect requests; policy coordination reduces conflicting false positives. However, the option would implement define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers; the scenario instead requires associate the WAF policy to the intended Application Gateway scope, listener or route as supported. The differentiating evidence is that the frontend shows the active policy association and a representative managed-rule test is logged.

Prevention mode can block matching HTTP requests, while detection mode is nonblocking. However, the option would implement change the tuned WAF policy to prevention mode and confirm the intended managed rule action; the scenario instead requires associate the WAF policy to the intended Application Gateway scope, listener or route as supported. The differentiating evidence is that the frontend shows the active policy association and a representative managed-rule test is logged.

That observation would primarily validate another control: validate symmetric request and return routes through the stateful inspection appliance. Stateful firewalls need consistent bidirectional session visibility or supported asymmetric-flow handling. The situation calls for evidence that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

That observation would primarily validate another control: renumber overlapping VNet address spaces before peering or design a supported translation boundary. Direct VNet peering does not resolve overlapping address-space ambiguity. The situation calls for evidence that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

That observation would primarily validate another control: inspect the effective-route longest-prefix match and add the proper more-specific route where supported. Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. The situation calls for evidence that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.