Front Door cache purging invalidates stale edge copies in supported scopes. However, the option would implement use the supported Front Door purge cache operation for affected URL patterns; the scenario instead requires deploy Azure Front Door with appropriate origin groups and endpoint routes. The differentiating evidence is that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

Public origins need defenses against clients bypassing edge WAF and delivery rules. However, the option would implement apply supported origin access restrictions using Front Door identification and approved security controls; the scenario instead requires deploy Azure Front Door with appropriate origin groups and endpoint routes. The differentiating evidence is that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

Edge origin health assessment should use a consistently reachable probe without costly application side effects. However, the option would implement configure an appropriate lightweight unauthenticated Front Door origin health probe path; the scenario instead requires deploy Azure Front Door with appropriate origin groups and endpoint routes. The differentiating evidence is that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

That observation would primarily validate another control: apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. NSGs filter packet tuples at subnet or NIC scope and can restrict access by source, destination, port and protocol. The situation calls for evidence that the VM downloads through the approved egress path and an external unsolicited connection is blocked.

That observation would primarily validate another control: correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. The situation calls for evidence that the VM downloads through the approved egress path and an external unsolicited connection is blocked.

That observation would primarily validate another control: use Azure Virtual Network Manager security admin configurations within supported scope. Security admin rules can centrally enforce network intent across managed VNet groups. The situation calls for evidence that the VM downloads through the approved egress path and an external unsolicited connection is blocked.

Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. However, the option would implement use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation; the scenario instead requires deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration. The differentiating evidence is that a permitted remote user establishes a client tunnel and reaches the assigned resource route.

Virtual WAN gateway components are service-specific; S2S VPN gateway does not terminate ExpressRoute. However, the option would implement provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits; the scenario instead requires deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration. The differentiating evidence is that a permitted remote user establishes a client tunnel and reaches the assigned resource route.

Basic and Standard Virtual WAN SKUs expose different hub and connectivity capabilities. However, the option would implement select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features; the scenario instead requires deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration. The differentiating evidence is that a permitted remote user establishes a client tunnel and reaches the assigned resource route.

That observation would primarily validate another control: design Virtual WAN traffic security explicitly with compatible firewall and routing features. Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. The situation calls for evidence that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

That observation would primarily validate another control: deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections. Virtual WAN Standard supports centralized hub routing and expanded branch/VNet connectivity services. The situation calls for evidence that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

That observation would primarily validate another control: select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features. Basic and Standard Virtual WAN SKUs expose different hub and connectivity capabilities. The situation calls for evidence that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

Central inspection is effective only if the policy meaningfully restricts destination and transport access. However, the option would implement replace blanket allows with least-privilege application and network rule collections; the scenario instead requires create an Azure Firewall application rule scoped to the required FQDN and protocol. The differentiating evidence is that the approved hostname works while an unrelated HTTPS hostname is denied and logged.

FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires create an Azure Firewall application rule scoped to the required FQDN and protocol. The differentiating evidence is that the approved hostname works while an unrelated HTTPS hostname is denied and logged.

Advanced IDPS and TLS inspection are Premium capabilities and require certificate and policy planning. However, the option would implement select Azure Firewall Premium and configure supported TLS inspection and IDPS settings; the scenario instead requires create an Azure Firewall application rule scoped to the required FQDN and protocol. The differentiating evidence is that the approved hostname works while an unrelated HTTPS hostname is denied and logged.

That observation would primarily validate another control: choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. The situation calls for evidence that the branch resolves and connects through a private endpoint or its own explicitly allowed service network path.

That observation would primarily validate another control: enable an appropriate virtual network service endpoint and allow the subnet in the service firewall. Service endpoints extend VNet identity to supported Azure services while service traffic uses the service's public endpoint. The situation calls for evidence that the branch resolves and connects through a private endpoint or its own explicitly allowed service network path.

That observation would primarily validate another control: use a private endpoint instead of a service endpoint for private-IP service access. Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. The situation calls for evidence that the branch resolves and connects through a private endpoint or its own explicitly allowed service network path.

A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. However, the option would implement deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device; the scenario instead requires resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU. The differentiating evidence is that the selected gateway instance scales successfully and its associated VPN remains healthy.

IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. However, the option would implement align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN; the scenario instead requires resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU. The differentiating evidence is that the selected gateway instance scales successfully and its associated VPN remains healthy.

Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. However, the option would implement choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed; the scenario instead requires resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU. The differentiating evidence is that the selected gateway instance scales successfully and its associated VPN remains healthy.

Service endpoints extend VNet identity to supported Azure services while service traffic uses the service's public endpoint. However, the option would implement enable an appropriate virtual network service endpoint and allow the subnet in the service firewall; the scenario instead requires allow the intended service-tag destination and necessary outbound flow in subnet security controls. The differentiating evidence is that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. However, the option would implement use a private endpoint instead of a service endpoint for private-IP service access; the scenario instead requires allow the intended service-tag destination and necessary outbound flow in subnet security controls. The differentiating evidence is that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

Service endpoint enablement alone does not grant access at the PaaS service network policy layer. However, the option would implement add the selected VNet/subnet to the target service's virtual network access rules; the scenario instead requires allow the intended service-tag destination and necessary outbound flow in subnet security controls. The differentiating evidence is that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. However, the option would implement complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate; the scenario instead requires apply supported origin access restrictions using Front Door identification and approved security controls. The differentiating evidence is that a request through Front Door succeeds and an unrelated direct-origin test is rejected.

Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. However, the option would implement use supported Front Door rules and geographic filtering where appropriate, plus origin segregation; the scenario instead requires apply supported origin access restrictions using Front Door identification and approved security controls. The differentiating evidence is that a request through Front Door succeeds and an unrelated direct-origin test is rejected.

Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. However, the option would implement use Front Door Premium Private Link origin connectivity and configure compatible origin private access; the scenario instead requires apply supported origin access restrictions using Front Door identification and approved security controls. The differentiating evidence is that a request through Front Door succeeds and an unrelated direct-origin test is rejected.

That observation would primarily validate another control: combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth. NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. The situation calls for evidence that the client and firewall resolve the intended destination consistently and matching traffic follows the expected rule.

That observation would primarily validate another control: associate the required UDR and validate effective routes across every protected workload subnet. Azure Firewall cannot inspect flows that routing directs around its data path. The situation calls for evidence that the client and firewall resolve the intended destination consistently and matching traffic follows the expected rule.

That observation would primarily validate another control: send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. The situation calls for evidence that the client and firewall resolve the intended destination consistently and matching traffic follows the expected rule.

That observation would primarily validate another control: review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence. Managed rule set versions can change match behavior and should be tested against legitimate traffic. The situation calls for evidence that a safe attack-like HTTP request matches WAF rules while a normal TLS request reaches the application.

That observation would primarily validate another control: change the tuned WAF policy to prevention mode and confirm the intended managed rule action. Prevention mode can block matching HTTP requests, while detection mode is nonblocking. The situation calls for evidence that a safe attack-like HTTP request matches WAF rules while a normal TLS request reaches the application.

That observation would primarily validate another control: associate the WAF policy to the intended Application Gateway scope, listener or route as supported. A standalone policy object does not inspect traffic until attached to an applicable gateway scope. The situation calls for evidence that a safe attack-like HTTP request matches WAF rules while a normal TLS request reaches the application.