That observation would primarily validate another control: validate symmetric request and return routes through the stateful inspection appliance. Stateful firewalls need consistent bidirectional session visibility or supported asymmetric-flow handling. The situation calls for evidence that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

That observation would primarily validate another control: renumber overlapping VNet address spaces before peering or design a supported translation boundary. Direct VNet peering does not resolve overlapping address-space ambiguity. The situation calls for evidence that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

That observation would primarily validate another control: inspect the effective-route longest-prefix match and add the proper more-specific route where supported. Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. The situation calls for evidence that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

That observation would primarily validate another control: scope and associate appropriate WAF security policies to supported domains or path patterns. WAF policy association and custom rule match conditions determine where application-layer controls apply. The situation calls for evidence that the analyst correlates the request ID with a specific rule and documents an approved remediation.

That observation would primarily validate another control: limit WAF exclusions to the smallest required match variable, field or rule. Broad WAF exclusions create avoidable blind spots while a targeted exception can preserve other detection coverage. The situation calls for evidence that the analyst correlates the request ID with a specific rule and documents an approved remediation.

That observation would primarily validate another control: deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters. NSGs enforce network transport rules and do not parse application attack payloads. The situation calls for evidence that the analyst correlates the request ID with a specific rule and documents an approved remediation.

Service endpoints are configured at subnet level, not automatically across an entire VNet. However, the option would implement enable the supported service endpoint on each specific subnet that requires the Azure service network identity; the scenario instead requires choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. The differentiating evidence is that the service firewall sees the allowed VNet/subnet and rejects requests from unapproved networks.

Service endpoint routing does not bypass independent NSG or resource firewall enforcement. However, the option would implement allow the intended service-tag destination and necessary outbound flow in subnet security controls; the scenario instead requires choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. The differentiating evidence is that the service firewall sees the allowed VNet/subnet and rejects requests from unapproved networks.

Service endpoint policies can narrow egress to supported Azure service resources rather than all accounts. However, the option would implement apply supported service endpoint policies with the authorized storage resource definitions; the scenario instead requires choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. The differentiating evidence is that the service firewall sees the allowed VNet/subnet and rejects requests from unapproved networks.

Managed service and FQDN tags reduce brittle static destination-IP maintenance for supported services. However, the option would implement use supported Azure Firewall FQDN tags or service-aware policy features where applicable; the scenario instead requires deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy. The differentiating evidence is that branch and spoke test egress follows the hub firewall and obeys the intended application rule.

FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy. The differentiating evidence is that branch and spoke test egress follows the hub firewall and obeys the intended application rule.

Basic, Standard and Premium tiers have different security capabilities and capacity. However, the option would implement choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost; the scenario instead requires deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy. The differentiating evidence is that branch and spoke test egress follows the hub firewall and obeys the intended application rule.

Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. However, the option would implement define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements; the scenario instead requires inspect peering status, route propagation and effective routes before changing security policies. The differentiating evidence is that the intended prefix appears on the affected NIC and a trace reaches the destination across the selected hop.

Direct VNet peering does not resolve overlapping address-space ambiguity. However, the option would implement renumber overlapping VNet address spaces before peering or design a supported translation boundary; the scenario instead requires inspect peering status, route propagation and effective routes before changing security policies. The differentiating evidence is that the intended prefix appears on the affected NIC and a trace reaches the destination across the selected hop.

VNet peering is not intrinsically transitive; a route or gateway strategy is required for spoke-to-spoke transit. However, the option would implement design an explicit routed transit path using an NVA or supported hub routing architecture; the scenario instead requires inspect peering status, route propagation and effective routes before changing security policies. The differentiating evidence is that the intended prefix appears on the affected NIC and a trace reaches the destination across the selected hop.

That observation would primarily validate another control: use the supported Front Door purge cache operation for affected URL patterns. Front Door cache purging invalidates stale edge copies in supported scopes. The situation calls for evidence that a request through Front Door succeeds and an unrelated direct-origin test is rejected.

That observation would primarily validate another control: create specific Front Door routes matching the intended domain and path patterns to origin groups. A route connects domain/path matching with the origin group and forwarding behavior. The situation calls for evidence that a request through Front Door succeeds and an unrelated direct-origin test is rejected.

That observation would primarily validate another control: complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. The situation calls for evidence that a request through Front Door succeeds and an unrelated direct-origin test is rejected.

WAF custom rate limits and bot controls can mitigate application-layer request floods when correctly scoped. However, the option would implement configure supported WAF rate-limit or bot protection rules at the appropriate edge scope; the scenario instead requires limit WAF exclusions to the smallest required match variable, field or rule. The differentiating evidence is that the legitimate header passes and a representative attack in unrelated fields remains detected.

Prevention mode can block matching HTTP requests, while detection mode is nonblocking. However, the option would implement change the tuned WAF policy to prevention mode and confirm the intended managed rule action; the scenario instead requires limit WAF exclusions to the smallest required match variable, field or rule. The differentiating evidence is that the legitimate header passes and a representative attack in unrelated fields remains detected.

A standalone policy object does not inspect traffic until attached to an applicable gateway scope. However, the option would implement associate the WAF policy to the intended Application Gateway scope, listener or route as supported; the scenario instead requires limit WAF exclusions to the smallest required match variable, field or rule. The differentiating evidence is that the legitimate header passes and a representative attack in unrelated fields remains detected.

Secured virtual hubs support managed firewall enforcement for connected traffic when routing is configured. However, the option would implement deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy; the scenario instead requires send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. The differentiating evidence is that an approved test deny yields a searchable event with source, destination and matching policy details.

Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. However, the option would implement configure a DNAT rule with the intended public destination, private target and matching security controls; the scenario instead requires send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. The differentiating evidence is that an approved test deny yields a searchable event with source, destination and matching policy details.

Azure Firewall policy evaluation order and processing rules determine which matching decision applies. However, the option would implement review Firewall Policy rule-collection-group and collection processing order and correct priorities; the scenario instead requires send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. The differentiating evidence is that an approved test deny yields a searchable event with source, destination and matching policy details.

That observation would primarily validate another control: combine service endpoint network rules with proper service authentication and RBAC or access policies. Network allow lists and data-plane authorization are independent controls. The situation calls for evidence that a client on the allowed subnet connects and a test client outside the service firewall rules is denied.

That observation would primarily validate another control: choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. The situation calls for evidence that a client on the allowed subnet connects and a test client outside the service firewall rules is denied.

That observation would primarily validate another control: enable an appropriate virtual network service endpoint and allow the subnet in the service firewall. Service endpoints extend VNet identity to supported Azure services while service traffic uses the service's public endpoint. The situation calls for evidence that a client on the allowed subnet connects and a test client outside the service firewall rules is denied.

Private endpoint NSG and UDR enforcement depends on subnet network policy configuration. However, the option would implement configure supported private endpoint network-policy settings and relevant NSG rules where enabled; the scenario instead requires create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points. The differentiating evidence is that a controlled source-address test is denied while permitted client ranges remain reachable.

Outbound client-initiated traffic and unsolicited inbound sessions are separate NSG directions. However, the option would implement configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules; the scenario instead requires create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points. The differentiating evidence is that a controlled source-address test is denied while permitted client ranges remain reachable.

Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. However, the option would implement store NSG configurations in versioned IaC and validate effective rules before and after deployment; the scenario instead requires create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points. The differentiating evidence is that a controlled source-address test is denied while permitted client ranges remain reachable.

That observation would primarily validate another control: start the WAF in detection mode, review matched rules and then enable prevention after tuning. Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. The situation calls for evidence that the analyst correlates the request ID with a specific rule and documents an approved remediation.

That observation would primarily validate another control: limit WAF exclusions to the smallest required match variable, field or rule. Broad WAF exclusions create avoidable blind spots while a targeted exception can preserve other detection coverage. The situation calls for evidence that the analyst correlates the request ID with a specific rule and documents an approved remediation.

That observation would primarily validate another control: define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers. Two WAF enforcement points can both inspect requests; policy coordination reduces conflicting false positives. The situation calls for evidence that the analyst correlates the request ID with a specific rule and documents an approved remediation.