That observation would primarily validate another control: create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. The situation calls for evidence that new member NICs receive expected traffic treatment and a nonmember remains excluded.

That observation would primarily validate another control: associate the NSG with the actual target subnet or network interface and validate effective policy. An unattached NSG does not evaluate workload traffic merely because its resource exists. The situation calls for evidence that new member NICs receive expected traffic treatment and a nonmember remains excluded.

That observation would primarily validate another control: use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. Direct Internet-wide RDP exposure is unnecessary when managed private administration is available. The situation calls for evidence that new member NICs receive expected traffic treatment and a nonmember remains excluded.

Point-to-site VPN is designed for individual client devices rather than fixed network-to-network peer sites. However, the option would implement configure Azure VPN Gateway point-to-site connectivity with an approved tunnel and client profile; the scenario instead requires configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets. The differentiating evidence is that a test user approved by RADIUS connects and a deliberately invalid credential is rejected.

Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. However, the option would implement select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication; the scenario instead requires configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets. The differentiating evidence is that a test user approved by RADIUS connects and a deliberately invalid credential is rejected.

P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. However, the option would implement constrain client routing and enforce destination access with NSGs and identity-aware controls; the scenario instead requires configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets. The differentiating evidence is that a test user approved by RADIUS connects and a deliberately invalid credential is rejected.

That observation would primarily validate another control: use Azure Route Server with a supported BGP peer to exchange routes dynamically. Route Server exchanges BGP information with compatible appliances and Azure networking instead of relying on static edits. The situation calls for evidence that a test VM's effective route and packet path show the intended appliance rather than unexpected NAT egress.

That observation would primarily validate another control: inspect the effective-route longest-prefix match and add the proper more-specific route where supported. Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. The situation calls for evidence that a test VM's effective route and packet path show the intended appliance rather than unexpected NAT egress.

That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that a test VM's effective route and packet path show the intended appliance rather than unexpected NAT egress.

Edge origin health assessment should use a consistently reachable probe without costly application side effects. However, the option would implement configure an appropriate lightweight unauthenticated Front Door origin health probe path; the scenario instead requires create Front Door rules for supported redirect or URL rewrite behavior on the matching route. The differentiating evidence is that a controlled request receives the required destination or reaches the rewritten origin path.

Front Door cache purging invalidates stale edge copies in supported scopes. However, the option would implement use the supported Front Door purge cache operation for affected URL patterns; the scenario instead requires create Front Door rules for supported redirect or URL rewrite behavior on the matching route. The differentiating evidence is that a controlled request receives the required destination or reaches the rewritten origin path.

Public origins need defenses against clients bypassing edge WAF and delivery rules. However, the option would implement apply supported origin access restrictions using Front Door identification and approved security controls; the scenario instead requires create Front Door rules for supported redirect or URL rewrite behavior on the matching route. The differentiating evidence is that a controlled request receives the required destination or reaches the rewritten origin path.

DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. However, the option would implement adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design; the scenario instead requires use Traffic Manager Performance routing with enabled healthy endpoints. The differentiating evidence is that queries from separated test locations resolve to the expected healthy regional endpoint under the policy.

Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. However, the option would implement use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing; the scenario instead requires use Traffic Manager Performance routing with enabled healthy endpoints. The differentiating evidence is that queries from separated test locations resolve to the expected healthy regional endpoint under the policy.

Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. However, the option would implement configure Azure Traffic Manager with the correct routing method and endpoint health checks; the scenario instead requires use Traffic Manager Performance routing with enabled healthy endpoints. The differentiating evidence is that queries from separated test locations resolve to the expected healthy regional endpoint under the policy.

Geographic filtering requires explicit request-based policy and should not be confused with backend origin placement. However, the option would implement define WAF custom geographic match rules or supported edge access controls for the target domains; the scenario instead requires scope and associate appropriate WAF security policies to supported domains or path patterns. The differentiating evidence is that the protected login route enforces stronger policy while public static content stays accessible as designed.

WAF custom rate limits and bot controls can mitigate application-layer request floods when correctly scoped. However, the option would implement configure supported WAF rate-limit or bot protection rules at the appropriate edge scope; the scenario instead requires scope and associate appropriate WAF security policies to supported domains or path patterns. The differentiating evidence is that the protected login route enforces stronger policy while public static content stays accessible as designed.

Broad WAF exclusions create avoidable blind spots while a targeted exception can preserve other detection coverage. However, the option would implement limit WAF exclusions to the smallest required match variable, field or rule; the scenario instead requires scope and associate appropriate WAF security policies to supported domains or path patterns. The differentiating evidence is that the protected login route enforces stronger policy while public static content stays accessible as designed.

That observation would primarily validate another control: create specific Front Door routes matching the intended domain and path patterns to origin groups. A route connects domain/path matching with the origin group and forwarding behavior. The situation calls for evidence that private connection reaches approved state and a health probe becomes successful.

That observation would primarily validate another control: create Front Door rules for supported redirect or URL rewrite behavior on the matching route. Front Door rules can modify edge request handling before forwarding to origin services. The situation calls for evidence that private connection reaches approved state and a health probe becomes successful.

That observation would primarily validate another control: place Front Door in front of appropriate regional origin gateways with correct host headers and probes. Front Door provides global entry and acceleration, while regional gateways retain local layer-7 capabilities. The situation calls for evidence that private connection reaches approved state and a health probe becomes successful.

Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. However, the option would implement provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway; the scenario instead requires create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. The differentiating evidence is that an authorized administrator opens an RDP or SSH session to a private VM without assigning it a public IP.

Gateway, Bastion, Firewall, private endpoint and application delivery components require space and specific subnet planning. However, the option would implement create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services; the scenario instead requires create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. The differentiating evidence is that an authorized administrator opens an RDP or SSH session to a private VM without assigning it a public IP.

Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. However, the option would implement reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility; the scenario instead requires create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. The differentiating evidence is that an authorized administrator opens an RDP or SSH session to a private VM without assigning it a public IP.

FastPath can improve the data path for supported ExpressRoute configurations by bypassing the gateway dataplane. However, the option would implement enable ExpressRoute FastPath on compatible circuits, gateways and network resources; the scenario instead requires inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. The differentiating evidence is that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. However, the option would implement configure Microsoft peering only for eligible services and with the required prefix authorization and route filters; the scenario instead requires inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. The differentiating evidence is that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

Private peering is a BGP arrangement and cannot establish with inconsistent peer identifiers or IP addressing. However, the option would implement match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters; the scenario instead requires inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. The differentiating evidence is that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

That observation would primarily validate another control: review Defender for Cloud Secure Score security recommendations for network resources. Secure Score recommendations expose actionable posture findings to prioritize weak network configurations. The situation calls for evidence that the tool reports the matching rule and an authorized test follows the expected action after remediation.

That observation would primarily validate another control: collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes. An allow rule alone cannot establish name resolution, correct next hop and application endpoint identity. The situation calls for evidence that the tool reports the matching rule and an authorized test follows the expected action after remediation.

That observation would primarily validate another control: enable supported VNet flow logs with the intended storage and analysis configuration. VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. The situation calls for evidence that the tool reports the matching rule and an authorized test follows the expected action after remediation.

Front Door cache purging invalidates stale edge copies in supported scopes. However, the option would implement use the supported Front Door purge cache operation for affected URL patterns; the scenario instead requires deploy Azure Front Door with appropriate origin groups and endpoint routes. The differentiating evidence is that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

Public origins need defenses against clients bypassing edge WAF and delivery rules. However, the option would implement apply supported origin access restrictions using Front Door identification and approved security controls; the scenario instead requires deploy Azure Front Door with appropriate origin groups and endpoint routes. The differentiating evidence is that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

Edge origin health assessment should use a consistently reachable probe without costly application side effects. However, the option would implement configure an appropriate lightweight unauthenticated Front Door origin health probe path; the scenario instead requires deploy Azure Front Door with appropriate origin groups and endpoint routes. The differentiating evidence is that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.