Network allow lists and data-plane authorization are independent controls. However, the option would implement combine service endpoint network rules with proper service authentication and RBAC or access policies; the scenario instead requires verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately. The differentiating evidence is that the approved client connects privately after old service endpoint rules are removed and unrelated requests remain denied.

Service endpoint routing does not bypass independent NSG or resource firewall enforcement. However, the option would implement allow the intended service-tag destination and necessary outbound flow in subnet security controls; the scenario instead requires verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately. The differentiating evidence is that the approved client connects privately after old service endpoint rules are removed and unrelated requests remain denied.

Service endpoints do not change a service FQDN into a consumer private endpoint address. However, the option would implement keep normal public service DNS and validate service endpoint route and subnet network-rule behavior; the scenario instead requires verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately. The differentiating evidence is that the approved client connects privately after old service endpoint rules are removed and unrelated requests remain denied.

That observation would primarily validate another control: use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. The situation calls for evidence that the approved hostname works while an unrelated HTTPS hostname is denied and logged.

That observation would primarily validate another control: correlate firewall decision logs with source and destination effective routes and return connectivity. A rule allow is not sufficient when a request or response never passes the expected firewall path. The situation calls for evidence that the approved hostname works while an unrelated HTTPS hostname is denied and logged.

That observation would primarily validate another control: send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. The situation calls for evidence that the approved hostname works while an unrelated HTTPS hostname is denied and logged.

P2S tunnel protocol support varies by gateway settings and VPN client platform. However, the option would implement choose a gateway-supported tunnel type compatible with the target operating systems and approved client software; the scenario instead requires provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration. The differentiating evidence is that the VPN client resolves the intended internal name privately and connects using that address.

Always On VPN is a client-side management design with specific tunnel and infrastructure requirements. However, the option would implement validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration; the scenario instead requires provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration. The differentiating evidence is that the VPN client resolves the intended internal name privately and connects using that address.

Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. However, the option would implement select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication; the scenario instead requires provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration. The differentiating evidence is that the VPN client resolves the intended internal name privately and connects using that address.

An ExpressRoute circuit alone is not a VNet-to-circuit connection without the gateway or supported architecture. However, the option would implement deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit; the scenario instead requires choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning. The differentiating evidence is that the contracted connectivity provider provisions the selected handoff and the circuit enters a usable state.

ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. However, the option would implement select an ExpressRoute SKU and connectivity design that supports the needed geographic reach; the scenario instead requires choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning. The differentiating evidence is that the contracted connectivity provider provisions the selected handoff and the circuit enters a usable state.

Circuit health and private peering do not guarantee a workload selects that route over more specific UDR entries. However, the option would implement inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection; the scenario instead requires choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning. The differentiating evidence is that the contracted connectivity provider provisions the selected handoff and the circuit enters a usable state.

That observation would primarily validate another control: apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. NSGs filter packet tuples at subnet or NIC scope and can restrict access by source, destination, port and protocol. The situation calls for evidence that the tool identifies the actual rule and the targeted test behaves correctly after remediation.

That observation would primarily validate another control: associate the NSG with the actual target subnet or network interface and validate effective policy. An unattached NSG does not evaluate workload traffic merely because its resource exists. The situation calls for evidence that the tool identifies the actual rule and the targeted test behaves correctly after remediation.

That observation would primarily validate another control: update NSG source or ASG membership for the new workload placement after validating its identity. IP-prefix and application security group membership determine which NSG rules match relocated workloads. The situation calls for evidence that the tool identifies the actual rule and the targeted test behaves correctly after remediation.

That observation would primarily validate another control: use a Private Link service with explicit connection approval and supported provider NAT configuration. A provider Private Link service can expose eligible private load-balanced workloads to consumer subscriptions. The situation calls for evidence that an approved consumer endpoint reaches the service while an unapproved connection remains denied.

That observation would primarily validate another control: provide separate approved private endpoints for each consumer to the shared eligible Private Link service. A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. The situation calls for evidence that an approved consumer endpoint reaches the service while an unapproved connection remains denied.

That observation would primarily validate another control: publish only the eligible Private Link service target with appropriate access policy rather than VNet peering. Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. The situation calls for evidence that an approved consumer endpoint reaches the service while an unapproved connection remains denied.

Hierarchical policies provide centralized baselines while allowing controlled local additions. However, the option would implement use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies; the scenario instead requires select Azure Firewall Premium and configure supported TLS inspection and IDPS settings. The differentiating evidence is that an approved safe detection sample produces an IDPS event and permitted TLS traffic is inspected without certificate errors.

A rule allow is not sufficient when a request or response never passes the expected firewall path. However, the option would implement correlate firewall decision logs with source and destination effective routes and return connectivity; the scenario instead requires select Azure Firewall Premium and configure supported TLS inspection and IDPS settings. The differentiating evidence is that an approved safe detection sample produces an IDPS event and permitted TLS traffic is inspected without certificate errors.

Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. However, the option would implement configure a DNAT rule with the intended public destination, private target and matching security controls; the scenario instead requires select Azure Firewall Premium and configure supported TLS inspection and IDPS settings. The differentiating evidence is that an approved safe detection sample produces an IDPS event and permitted TLS traffic is inspected without certificate errors.

Azure Firewall uses a specific reserved subnet name and supported minimum capacity for deployment and scaling. However, the option would implement provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall; the scenario instead requires create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services. The differentiating evidence is that future-service subnet reservations fit without overlapping or requiring emergency VNet renumbering.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services. The differentiating evidence is that future-service subnet reservations fit without overlapping or requiring emergency VNet renumbering.

A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. However, the option would implement use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources; the scenario instead requires create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services. The differentiating evidence is that future-service subnet reservations fit without overlapping or requiring emergency VNet renumbering.

Public Load Balancer distributes layer-4 flows across healthy backends without inspecting URL paths. However, the option would implement deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes; the scenario instead requires adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. The differentiating evidence is that after the TTL window, fresh queries resolve to the healthy selected endpoint and the standby service responds.

Weighted Traffic Manager policies influence DNS answer distribution across eligible healthy endpoints. However, the option would implement configure Traffic Manager Weighted routing across the regional endpoints; the scenario instead requires adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. The differentiating evidence is that after the TTL window, fresh queries resolve to the healthy selected endpoint and the standby service responds.

Load balancing applies only to members registered in its backend pool and passing health checks. However, the option would implement register eligible NIC IP configurations or supported resources in the load balancer backend pool; the scenario instead requires adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. The differentiating evidence is that after the TTL window, fresh queries resolve to the healthy selected endpoint and the standby service responds.

That observation would primarily validate another control: define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers. Two WAF enforcement points can both inspect requests; policy coordination reduces conflicting false positives. The situation calls for evidence that the legitimate header passes and a representative attack in unrelated fields remains detected.

That observation would primarily validate another control: change the tuned WAF policy to prevention mode and confirm the intended managed rule action. Prevention mode can block matching HTTP requests, while detection mode is nonblocking. The situation calls for evidence that the legitimate header passes and a representative attack in unrelated fields remains detected.

That observation would primarily validate another control: use WAF diagnostic logs to identify matched policy, rule and client/request details. Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. The situation calls for evidence that the legitimate header passes and a representative attack in unrelated fields remains detected.

FastPath can improve the data path for supported ExpressRoute configurations by bypassing the gateway dataplane. However, the option would implement enable ExpressRoute FastPath on compatible circuits, gateways and network resources; the scenario instead requires inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. The differentiating evidence is that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

ExpressRoute provides private connectivity through a provider path, subject to service and circuit design. However, the option would implement provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering; the scenario instead requires inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. The differentiating evidence is that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. However, the option would implement select an ExpressRoute SKU and connectivity design that supports the needed geographic reach; the scenario instead requires inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. The differentiating evidence is that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.