That observation would primarily validate another control: start the WAF in detection mode, review matched rules and then enable prevention after tuning. Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. The situation calls for evidence that the analyst correlates the request ID with a specific rule and documents an approved remediation.

That observation would primarily validate another control: limit WAF exclusions to the smallest required match variable, field or rule. Broad WAF exclusions create avoidable blind spots while a targeted exception can preserve other detection coverage. The situation calls for evidence that the analyst correlates the request ID with a specific rule and documents an approved remediation.

That observation would primarily validate another control: define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers. Two WAF enforcement points can both inspect requests; policy coordination reduces conflicting false positives. The situation calls for evidence that the analyst correlates the request ID with a specific rule and documents an approved remediation.

That observation would primarily validate another control: correct Virtual WAN route table associations and propagation labels for the connected networks. Virtual hub routing depends on the association and propagation configuration of each connection. The situation calls for evidence that a permitted remote user establishes a client tunnel and reaches the assigned resource route.

That observation would primarily validate another control: use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. The situation calls for evidence that a permitted remote user establishes a client tunnel and reaches the assigned resource route.

That observation would primarily validate another control: provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits. Virtual WAN gateway components are service-specific; S2S VPN gateway does not terminate ExpressRoute. The situation calls for evidence that a permitted remote user establishes a client tunnel and reaches the assigned resource route.

Secured virtual hubs support managed firewall enforcement for connected traffic when routing is configured. However, the option would implement deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy; the scenario instead requires review Firewall Policy rule-collection-group and collection processing order and correct priorities. The differentiating evidence is that the expected collection handles a controlled test packet and its matching rule is logged.

A rule allow is not sufficient when a request or response never passes the expected firewall path. However, the option would implement correlate firewall decision logs with source and destination effective routes and return connectivity; the scenario instead requires review Firewall Policy rule-collection-group and collection processing order and correct priorities. The differentiating evidence is that the expected collection handles a controlled test packet and its matching rule is logged.

Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. However, the option would implement send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination; the scenario instead requires review Firewall Policy rule-collection-group and collection processing order and correct priorities. The differentiating evidence is that the expected collection handles a controlled test packet and its matching rule is logged.

That observation would primarily validate another control: link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path. Inbound Private Resolver resolves private zones available through its network's DNS resolution context. The situation calls for evidence that public DNS queries return the planned A address and the independent mail exchanger entries.

That observation would primarily validate another control: enable autoregistration for the appropriate VNet link to an Azure Private DNS zone. Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. The situation calls for evidence that public DNS queries return the planned A address and the independent mail exchanger entries.

That observation would primarily validate another control: apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. DNS-layer policy can block known malicious domains without treating an IP firewall allow rule as DNS security. The situation calls for evidence that public DNS queries return the planned A address and the independent mail exchanger entries.

That observation would primarily validate another control: reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants. Azure Firewall provisioning requires its reserved subnet and adequate address capacity. The situation calls for evidence that authorized dependencies remain functional while representative prohibited destinations are denied.

That observation would primarily validate another control: select Azure Firewall Premium and configure supported TLS inspection and IDPS settings. Advanced IDPS and TLS inspection are Premium capabilities and require certificate and policy planning. The situation calls for evidence that authorized dependencies remain functional while representative prohibited destinations are denied.

That observation would primarily validate another control: deploy Azure Firewall into a supported hub and route workload egress through its private IP. Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. The situation calls for evidence that authorized dependencies remain functional while representative prohibited destinations are denied.

Inbound Private Resolver resolves private zones available through its network's DNS resolution context. However, the option would implement link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path; the scenario instead requires refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings. The differentiating evidence is that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

Outbound endpoints and forwarding rules let Azure-resident clients resolve selected external DNS namespaces. However, the option would implement configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix; the scenario instead requires refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings. The differentiating evidence is that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. However, the option would implement add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace; the scenario instead requires refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings. The differentiating evidence is that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. However, the option would implement configure P2S root certificate trust and issue valid client certificates from the approved CA; the scenario instead requires configure Azure VPN Gateway point-to-site connectivity with an approved tunnel and client profile. The differentiating evidence is that an authorized remote device connects and reaches an approved private Azure subnet.

P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. However, the option would implement constrain client routing and enforce destination access with NSGs and identity-aware controls; the scenario instead requires configure Azure VPN Gateway point-to-site connectivity with an approved tunnel and client profile. The differentiating evidence is that an authorized remote device connects and reaches an approved private Azure subnet.

P2S tunnel protocol support varies by gateway settings and VPN client platform. However, the option would implement choose a gateway-supported tunnel type compatible with the target operating systems and approved client software; the scenario instead requires configure Azure VPN Gateway point-to-site connectivity with an approved tunnel and client profile. The differentiating evidence is that an authorized remote device connects and reaches an approved private Azure subnet.

That observation would primarily validate another control: align Application Gateway backend host-name and health-probe configuration with the origin virtual host. Layer-7 backend routing and TLS validation depend on the host and protocol settings. The situation calls for evidence that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

That observation would primarily validate another control: deploy Azure Application Gateway with HTTPS listener and path-based routing rules. Application Gateway provides regional layer-7 routing and TLS termination for HTTP services. The situation calls for evidence that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

That observation would primarily validate another control: configure HTTPS backend settings with suitable server certificate trust and host-name handling. Frontend TLS termination does not automatically encrypt the independent gateway-to-backend connection. The situation calls for evidence that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

That observation would primarily validate another control: link the intended spoke VNet to the appropriate DNS forwarding ruleset. Ruleset links determine which VNets apply the conditional forwarding rules; peering alone is insufficient. The situation calls for evidence that an approved VM resolves the service FQDN to the private endpoint address and connects privately.

That observation would primarily validate another control: configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. Outbound endpoints and forwarding rules let Azure-resident clients resolve selected external DNS namespaces. The situation calls for evidence that an approved VM resolves the service FQDN to the private endpoint address and connects privately.

That observation would primarily validate another control: enable autoregistration for the appropriate VNet link to an Azure Private DNS zone. Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. The situation calls for evidence that an approved VM resolves the service FQDN to the private endpoint address and connects privately.

That observation would primarily validate another control: enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs. DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. The situation calls for evidence that an inventory query flags uncovered endpoints and shows the expected protection association after correction.

That observation would primarily validate another control: use Network Watcher connectivity testing and route diagnostics from a representative Azure source. Healthy connection resources do not prove application reachability across security and routing boundaries. The situation calls for evidence that an inventory query flags uncovered endpoints and shows the expected protection association after correction.

That observation would primarily validate another control: collect virtual network gateway diagnostic logs and metrics into centralized monitoring. VPN disconnect and gateway events require historical telemetry, not only current status views. The situation calls for evidence that an inventory query flags uncovered endpoints and shows the expected protection association after correction.

Network allow lists and data-plane authorization are independent controls. However, the option would implement combine service endpoint network rules with proper service authentication and RBAC or access policies; the scenario instead requires verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately. The differentiating evidence is that the approved client connects privately after old service endpoint rules are removed and unrelated requests remain denied.

Service endpoint routing does not bypass independent NSG or resource firewall enforcement. However, the option would implement allow the intended service-tag destination and necessary outbound flow in subnet security controls; the scenario instead requires verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately. The differentiating evidence is that the approved client connects privately after old service endpoint rules are removed and unrelated requests remain denied.

Service endpoints do not change a service FQDN into a consumer private endpoint address. However, the option would implement keep normal public service DNS and validate service endpoint route and subnet network-rule behavior; the scenario instead requires verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately. The differentiating evidence is that the approved client connects privately after old service endpoint rules are removed and unrelated requests remain denied.