Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. However, the option would implement configure Microsoft peering only for eligible services and with the required prefix authorization and route filters; the scenario instead requires use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. The differentiating evidence is that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

A private transport path is not inherently end-to-end payload encryption for compliance purposes. However, the option would implement add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate; the scenario instead requires use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. The differentiating evidence is that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

ExpressRoute provides private connectivity through a provider path, subject to service and circuit design. However, the option would implement provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering; the scenario instead requires use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. The differentiating evidence is that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

That observation would primarily validate another control: send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. The situation calls for evidence that both intended firewalls report the applied policy version and enforce the same representative test rule.

That observation would primarily validate another control: choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost. Basic, Standard and Premium tiers have different security capabilities and capacity. The situation calls for evidence that both intended firewalls report the applied policy version and enforce the same representative test rule.

That observation would primarily validate another control: deploy Azure Firewall into a supported hub and route workload egress through its private IP. Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. The situation calls for evidence that both intended firewalls report the applied policy version and enforce the same representative test rule.

Secure Score recommendations expose actionable posture findings to prioritize weak network configurations. However, the option would implement review Defender for Cloud Secure Score security recommendations for network resources; the scenario instead requires use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes. The differentiating evidence is that the diagnostic report pinpoints the failing hop or rule and a retest passes after the targeted correction.

Collecting network flows is useful only if relevant logs reach an authorized searchable destination. However, the option would implement route VNet flow telemetry into supported storage or traffic analytics with access and retention controls; the scenario instead requires use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes. The differentiating evidence is that the diagnostic report pinpoints the failing hop or rule and a retest passes after the targeted correction.

DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. However, the option would implement enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs; the scenario instead requires use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes. The differentiating evidence is that the diagnostic report pinpoints the failing hop or rule and a retest passes after the targeted correction.

That observation would primarily validate another control: use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. Hierarchical policies provide centralized baselines while allowing controlled local additions. The situation calls for evidence that the expected collection handles a controlled test packet and its matching rule is logged.

That observation would primarily validate another control: create an Azure Firewall application rule scoped to the required FQDN and protocol. Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. The situation calls for evidence that the expected collection handles a controlled test packet and its matching rule is logged.

That observation would primarily validate another control: enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering. FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. The situation calls for evidence that the expected collection handles a controlled test packet and its matching rule is logged.

Private Link endpoint creation does not guarantee client DNS queries return the private IP. However, the option would implement link the correct service-specific private DNS zone to the client VNet and verify A-record resolution; the scenario instead requires require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. The differentiating evidence is that unapproved endpoint requests stay pending or rejected and approved consumers connect successfully.

Some Private Link connections require resource-owner approval before private traffic is accepted. However, the option would implement approve the intended private endpoint connection on the target resource before testing access; the scenario instead requires require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. The differentiating evidence is that unapproved endpoint requests stay pending or rejected and approved consumers connect successfully.

A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. However, the option would implement provide separate approved private endpoints for each consumer to the shared eligible Private Link service; the scenario instead requires require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. The differentiating evidence is that unapproved endpoint requests stay pending or rejected and approved consumers connect successfully.

That observation would primarily validate another control: use the supported Front Door purge cache operation for affected URL patterns. Front Door cache purging invalidates stale edge copies in supported scopes. The situation calls for evidence that a distant client uses the edge address and backend logs show correct host-based routing through the regional gateway.

That observation would primarily validate another control: complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. The situation calls for evidence that a distant client uses the edge address and backend logs show correct host-based routing through the regional gateway.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that a distant client uses the edge address and backend logs show correct host-based routing through the regional gateway.

That observation would primarily validate another control: create appropriate public-zone A records for IPv4 and MX records for mail routing. DNS record types have distinct purposes: A provides IPv4 host resolution while MX selects mail exchangers. The situation calls for evidence that the test VNet resolves the test target while a production VNet resolves its approved production target.

That observation would primarily validate another control: remove a self-referential forwarding ruleset link or rule to prevent a resolver forwarding loop. Forwarding to an inbound endpoint from a ruleset linked to that same resolver VNet can cause a DNS loop. The situation calls for evidence that the test VNet resolves the test target while a production VNet resolves its approved production target.

That observation would primarily validate another control: add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace. Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. The situation calls for evidence that the test VNet resolves the test target while a production VNet resolves its approved production target.

Central inspection is effective only if the policy meaningfully restricts destination and transport access. However, the option would implement replace blanket allows with least-privilege application and network rule collections; the scenario instead requires use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. The differentiating evidence is that both intended firewalls report the applied policy version and enforce the same representative test rule.

Azure Firewall policy evaluation order and processing rules determine which matching decision applies. However, the option would implement review Firewall Policy rule-collection-group and collection processing order and correct priorities; the scenario instead requires use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. The differentiating evidence is that both intended firewalls report the applied policy version and enforce the same representative test rule.

A rule allow is not sufficient when a request or response never passes the expected firewall path. However, the option would implement correlate firewall decision logs with source and destination effective routes and return connectivity; the scenario instead requires use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. The differentiating evidence is that both intended firewalls report the applied policy version and enforce the same representative test rule.

That observation would primarily validate another control: configure route propagation from the branch connection into the spoke's associated route table. Virtual hub route-table propagation determines which connection prefixes are visible to each subscriber. The situation calls for evidence that the intended gateway and secured-hub features can be provisioned and expected connections establish.

That observation would primarily validate another control: use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model. Virtual WAN supports specific managed NVA integrations and partner deployment requirements. The situation calls for evidence that the intended gateway and secured-hub features can be provisioned and expected connections establish.

That observation would primarily validate another control: deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. The situation calls for evidence that the intended gateway and secured-hub features can be provisioned and expected connections establish.

That observation would primarily validate another control: use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required. A service endpoint is a VNet subnet property and does not directly make arbitrary branch source IPs part of that subnet. The situation calls for evidence that the service firewall sees the allowed VNet/subnet and rejects requests from unapproved networks.

That observation would primarily validate another control: review service endpoint behavior and update the target service's VNet network rules rather than relying only on public egress IPs. Service endpoint traffic is governed by virtual network identity and service firewall rules. The situation calls for evidence that the service firewall sees the allowed VNet/subnet and rejects requests from unapproved networks.

That observation would primarily validate another control: apply supported service endpoint policies with the authorized storage resource definitions. Service endpoint policies can narrow egress to supported Azure service resources rather than all accounts. The situation calls for evidence that the service firewall sees the allowed VNet/subnet and rejects requests from unapproved networks.

Security admin rules can centrally enforce network intent across managed VNet groups. However, the option would implement use Azure Virtual Network Manager security admin configurations within supported scope; the scenario instead requires correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. The differentiating evidence is that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

NSG policy evaluation sees packet addresses at its network scope rather than assuming Internet NAT addresses. However, the option would implement match NSG rules to the effective private source and destination packet addresses at the NIC boundary; the scenario instead requires correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. The differentiating evidence is that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

New NSG flow logs are no longer supported; VNet flow logs are the recommended replacement. However, the option would implement enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment; the scenario instead requires correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. The differentiating evidence is that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.