Security admin rules can centrally enforce network intent across managed VNet groups. However, the option would implement use Azure Virtual Network Manager security admin configurations within supported scope; the scenario instead requires correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. The differentiating evidence is that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

NSG policy evaluation sees packet addresses at its network scope rather than assuming Internet NAT addresses. However, the option would implement match NSG rules to the effective private source and destination packet addresses at the NIC boundary; the scenario instead requires correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. The differentiating evidence is that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

New NSG flow logs are no longer supported; VNet flow logs are the recommended replacement. However, the option would implement enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment; the scenario instead requires correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. The differentiating evidence is that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. However, the option would implement enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs; the scenario instead requires use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends. The differentiating evidence is that the view shows a time-aligned degradation on the affected connection and recovery after the fix.

Time-series health signals and actionable alert thresholds provide earlier detection than manual portal checks. However, the option would implement set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection; the scenario instead requires use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends. The differentiating evidence is that the view shows a time-aligned degradation on the affected connection and recovery after the fix.

Effective NSG evaluation identifies the allow or deny rule governing a specific flow. However, the option would implement use Network Watcher IP flow verify or effective security rules for the exact source/destination tuple; the scenario instead requires use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends. The differentiating evidence is that the view shows a time-aligned degradation on the affected connection and recovery after the fix.

Bring-your-own-IP requires prefix validation and provisioning rather than treating any arbitrary public range as Azure owned. However, the option would implement use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs; the scenario instead requires create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services. The differentiating evidence is that future-service subnet reservations fit without overlapping or requiring emergency VNet renumbering.

Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. However, the option would implement create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet; the scenario instead requires create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services. The differentiating evidence is that future-service subnet reservations fit without overlapping or requiring emergency VNet renumbering.

Azure Firewall uses a specific reserved subnet name and supported minimum capacity for deployment and scaling. However, the option would implement provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall; the scenario instead requires create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services. The differentiating evidence is that future-service subnet reservations fit without overlapping or requiring emergency VNet renumbering.

That observation would primarily validate another control: create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. The situation calls for evidence that the failing flow is attributed to a specific NSG decision or listener issue and the correct fix is confirmed.

That observation would primarily validate another control: apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. NSGs filter packet tuples at subnet or NIC scope and can restrict access by source, destination, port and protocol. The situation calls for evidence that the failing flow is attributed to a specific NSG decision or listener issue and the correct fix is confirmed.

That observation would primarily validate another control: correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. The situation calls for evidence that the failing flow is attributed to a specific NSG decision or listener issue and the correct fix is confirmed.

That observation would primarily validate another control: use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. BFD can detect forwarding failures rapidly and inform BGP convergence where supported. The situation calls for evidence that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

That observation would primarily validate another control: enable ExpressRoute FastPath on compatible circuits, gateways and network resources. FastPath can improve the data path for supported ExpressRoute configurations by bypassing the gateway dataplane. The situation calls for evidence that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

That observation would primarily validate another control: inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. Circuit health and private peering do not guarantee a workload selects that route over more specific UDR entries. The situation calls for evidence that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

That observation would primarily validate another control: use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. The situation calls for evidence that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

That observation would primarily validate another control: deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. The situation calls for evidence that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

That observation would primarily validate another control: use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model. Virtual WAN supports specific managed NVA integrations and partner deployment requirements. The situation calls for evidence that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

That observation would primarily validate another control: provide separate approved private endpoints for each consumer to the shared eligible Private Link service. A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. The situation calls for evidence that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

That observation would primarily validate another control: publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints. Private Link service exposes a provider-hosted private service to consumer private endpoints. The situation calls for evidence that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

That observation would primarily validate another control: check resource-specific Private Link support, subresource group IDs and regional availability before implementation. Private endpoint connectivity depends on the destination service's supported private link capabilities. The situation calls for evidence that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

Healthy connection resources do not prove application reachability across security and routing boundaries. However, the option would implement use Network Watcher connectivity testing and route diagnostics from a representative Azure source; the scenario instead requires enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs. The differentiating evidence is that protection status is correct and authorized monitoring reports mitigation metrics during a test or observed attack.

Secure Score recommendations expose actionable posture findings to prioritize weak network configurations. However, the option would implement review Defender for Cloud Secure Score security recommendations for network resources; the scenario instead requires enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs. The differentiating evidence is that protection status is correct and authorized monitoring reports mitigation metrics during a test or observed attack.

Collecting network flows is useful only if relevant logs reach an authorized searchable destination. However, the option would implement route VNet flow telemetry into supported storage or traffic analytics with access and retention controls; the scenario instead requires enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs. The differentiating evidence is that protection status is correct and authorized monitoring reports mitigation metrics during a test or observed attack.

That observation would primarily validate another control: update local network gateway address spaces or validated BGP advertisements for the missing prefix. A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. The situation calls for evidence that negotiation completes with matching selectors and the configured on-premises network prefixes are reachable.

That observation would primarily validate another control: design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. Internet-bound branch traffic requires explicit default-route propagation and a compatible secured hub path. The situation calls for evidence that negotiation completes with matching selectors and the configured on-premises network prefixes are reachable.

That observation would primarily validate another control: enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. BGP distributes network prefixes across compatible VPN peers, avoiding repeated manual network updates. The situation calls for evidence that negotiation completes with matching selectors and the configured on-premises network prefixes are reachable.

That observation would primarily validate another control: configure an appropriate lightweight unauthenticated Front Door origin health probe path. Edge origin health assessment should use a consistently reachable probe without costly application side effects. The situation calls for evidence that the hostname resolves to Front Door and an external client negotiates TLS with its correct certificate.

That observation would primarily validate another control: apply supported origin access restrictions using Front Door identification and approved security controls. Public origins need defenses against clients bypassing edge WAF and delivery rules. The situation calls for evidence that the hostname resolves to Front Door and an external client negotiates TLS with its correct certificate.

That observation would primarily validate another control: configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates. The client-to-edge and edge-to-origin TLS connections are distinct and must both be configured. The situation calls for evidence that the hostname resolves to Front Door and an external client negotiates TLS with its correct certificate.

That observation would primarily validate another control: use a private endpoint instead of a service endpoint for private-IP service access. Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. The situation calls for evidence that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

That observation would primarily validate another control: enable the supported service endpoint on each specific subnet that requires the Azure service network identity. Service endpoints are configured at subnet level, not automatically across an entire VNet. The situation calls for evidence that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

That observation would primarily validate another control: keep normal public service DNS and validate service endpoint route and subnet network-rule behavior. Service endpoints do not change a service FQDN into a consumer private endpoint address. The situation calls for evidence that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.