That observation would primarily validate another control: create an internal Azure Load Balancer with a private frontend and eligible backend pool. Azure Load Balancer distributes layer-4 traffic to backend endpoints while an internal frontend stays private. The situation calls for evidence that both registered healthy instances receive requests under an observed distribution sample.

That observation would primarily validate another control: adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. The situation calls for evidence that both registered healthy instances receive requests under an observed distribution sample.

That observation would primarily validate another control: configure appropriate Load Balancer probe and rollout health gating for backend readiness. Probe-driven backend health prevents new flows from being distributed to failing endpoints. The situation calls for evidence that both registered healthy instances receive requests under an observed distribution sample.

NSGs enforce network transport rules and do not parse application attack payloads. However, the option would implement deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters; the scenario instead requires change the tuned WAF policy to prevention mode and confirm the intended managed rule action. The differentiating evidence is that the safe test produces the expected block status and origin logs show no delivered malicious request.

Two WAF enforcement points can both inspect requests; policy coordination reduces conflicting false positives. However, the option would implement define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers; the scenario instead requires change the tuned WAF policy to prevention mode and confirm the intended managed rule action. The differentiating evidence is that the safe test produces the expected block status and origin logs show no delivered malicious request.

Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. However, the option would implement use WAF diagnostic logs to identify matched policy, rule and client/request details; the scenario instead requires change the tuned WAF policy to prevention mode and confirm the intended managed rule action. The differentiating evidence is that the safe test produces the expected block status and origin logs show no delivered malicious request.

Virtual hub route-table propagation determines which connection prefixes are visible to each subscriber. However, the option would implement configure route propagation from the branch connection into the spoke's associated route table; the scenario instead requires use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model. The differentiating evidence is that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

Virtual WAN supports user VPN gateways for individually authenticated client connectivity. However, the option would implement deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration; the scenario instead requires use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model. The differentiating evidence is that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. However, the option would implement use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation; the scenario instead requires use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model. The differentiating evidence is that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

Different Virtual WAN gateway types have configurable scale units and supported limits. However, the option would implement choose the appropriate Virtual WAN hub gateway scale units and capacity parameters; the scenario instead requires correct Virtual WAN route table associations and propagation labels for the connected networks. The differentiating evidence is that route tables show the intended prefixes and application testing reaches the branch destination.

Basic and Standard Virtual WAN SKUs expose different hub and connectivity capabilities. However, the option would implement select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features; the scenario instead requires correct Virtual WAN route table associations and propagation labels for the connected networks. The differentiating evidence is that route tables show the intended prefixes and application testing reaches the branch destination.

Virtual WAN supports specific managed NVA integrations and partner deployment requirements. However, the option would implement use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model; the scenario instead requires correct Virtual WAN route table associations and propagation labels for the connected networks. The differentiating evidence is that route tables show the intended prefixes and application testing reaches the branch destination.

Subnet delegation is scoped to supported service providers and imposes placement constraints. However, the option would implement choose the service-supported delegated subnet and remove incompatible delegation or workload placements; the scenario instead requires add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. The differentiating evidence is that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

Peering and hybrid routing require unambiguous destinations; overlapping prefixes prevent intended reachability. However, the option would implement allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity; the scenario instead requires add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. The differentiating evidence is that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

Azure Firewall uses a specific reserved subnet name and supported minimum capacity for deployment and scaling. However, the option would implement provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall; the scenario instead requires add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. The differentiating evidence is that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

Service endpoint traffic is governed by virtual network identity and service firewall rules. However, the option would implement review service endpoint behavior and update the target service's VNet network rules rather than relying only on public egress IPs; the scenario instead requires verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately. The differentiating evidence is that the approved client connects privately after old service endpoint rules are removed and unrelated requests remain denied.

Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. However, the option would implement choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing; the scenario instead requires verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately. The differentiating evidence is that the approved client connects privately after old service endpoint rules are removed and unrelated requests remain denied.

Service endpoints extend VNet identity to supported Azure services while service traffic uses the service's public endpoint. However, the option would implement enable an appropriate virtual network service endpoint and allow the subnet in the service firewall; the scenario instead requires verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately. The differentiating evidence is that the approved client connects privately after old service endpoint rules are removed and unrelated requests remain denied.

That observation would primarily validate another control: respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. The situation calls for evidence that an effective-route check selects the intended specific prefix and test packets reach the right target.

That observation would primarily validate another control: deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. Centralized change definitions make route and topology deviations detectable before deployment. The situation calls for evidence that an effective-route check selects the intended specific prefix and test packets reach the right target.

That observation would primarily validate another control: attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet. NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. The situation calls for evidence that an effective-route check selects the intended specific prefix and test packets reach the right target.

Subnet NAT Gateway supplies outbound-only address translation without creating VM public listeners. However, the option would implement place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs; the scenario instead requires review effective routes and keep the explicit appliance route when inspected forced tunneling is required. The differentiating evidence is that a test VM's effective route and packet path show the intended appliance rather than unexpected NAT egress.

Forced tunneling through an appliance requires an explicit default route from the workload subnet. However, the option would implement apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop; the scenario instead requires review effective routes and keep the explicit appliance route when inspected forced tunneling is required. The differentiating evidence is that a test VM's effective route and packet path show the intended appliance rather than unexpected NAT egress.

A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. However, the option would implement respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists; the scenario instead requires review effective routes and keep the explicit appliance route when inspected forced tunneling is required. The differentiating evidence is that a test VM's effective route and packet path show the intended appliance rather than unexpected NAT egress.

Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. However, the option would implement store NSG configurations in versioned IaC and validate effective rules before and after deployment; the scenario instead requires configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules. The differentiating evidence is that the VM downloads through the approved egress path and an external unsolicited connection is blocked.

Security admin rules can centrally enforce network intent across managed VNet groups. However, the option would implement use Azure Virtual Network Manager security admin configurations within supported scope; the scenario instead requires configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules. The differentiating evidence is that the VM downloads through the approved egress path and an external unsolicited connection is blocked.

NSGs filter packet tuples at subnet or NIC scope and can restrict access by source, destination, port and protocol. However, the option would implement apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls; the scenario instead requires configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules. The differentiating evidence is that the VM downloads through the approved egress path and an external unsolicited connection is blocked.

Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. However, the option would implement create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet; the scenario instead requires allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity. The differentiating evidence is that the documented address plan has no overlap and effective routes deliver packets to the intended VNet or site.

Azure Firewall uses a specific reserved subnet name and supported minimum capacity for deployment and scaling. However, the option would implement provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall; the scenario instead requires allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity. The differentiating evidence is that the documented address plan has no overlap and effective routes deliver packets to the intended VNet or site.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity. The differentiating evidence is that the documented address plan has no overlap and effective routes deliver packets to the intended VNet or site.

That observation would primarily validate another control: enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment. New NSG flow logs are no longer supported; VNet flow logs are the recommended replacement. The situation calls for evidence that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

That observation would primarily validate another control: use the appropriate Azure service tag for supported NSG destination restrictions. Azure service tags abstract changing Azure service address ranges in network security rules. The situation calls for evidence that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

That observation would primarily validate another control: configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules. Outbound client-initiated traffic and unsolicited inbound sessions are separate NSG directions. The situation calls for evidence that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.