That observation would primarily validate another control: create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. The situation calls for evidence that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

That observation would primarily validate another control: add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace. Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. The situation calls for evidence that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

That observation would primarily validate another control: refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings. Existing workloads may retain DNS settings obtained before a VNet-level resolver change. The situation calls for evidence that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

That observation would primarily validate another control: remove a self-referential forwarding ruleset link or rule to prevent a resolver forwarding loop. Forwarding to an inbound endpoint from a ruleset linked to that same resolver VNet can cause a DNS loop. The situation calls for evidence that both endpoint resources provision successfully into separate delegated subnets without subnet constraint failures.

That observation would primarily validate another control: refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings. Existing workloads may retain DNS settings obtained before a VNet-level resolver change. The situation calls for evidence that both endpoint resources provision successfully into separate delegated subnets without subnet constraint failures.

That observation would primarily validate another control: separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. Name resolution visibility is determined by private-zone linking and namespace selection. The situation calls for evidence that both endpoint resources provision successfully into separate delegated subnets without subnet constraint failures.

That observation would primarily validate another control: review Firewall Policy rule-collection-group and collection processing order and correct priorities. Azure Firewall policy evaluation order and processing rules determine which matching decision applies. The situation calls for evidence that the approved hostname works while an unrelated HTTPS hostname is denied and logged.

That observation would primarily validate another control: deploy Azure Firewall into a supported hub and route workload egress through its private IP. Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. The situation calls for evidence that the approved hostname works while an unrelated HTTPS hostname is denied and logged.

That observation would primarily validate another control: send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. The situation calls for evidence that the approved hostname works while an unrelated HTTPS hostname is denied and logged.

Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. However, the option would implement use Front Door Premium Private Link origin connectivity and configure compatible origin private access; the scenario instead requires create specific Front Door routes matching the intended domain and path patterns to origin groups. The differentiating evidence is that requests with each route pattern reach the intended origin while unmatched patterns follow the designed default.

Front Door origin selection depends on health probes and configured origin priority or weight. However, the option would implement configure Front Door origin-group health probes and suitable priority or weight settings; the scenario instead requires create specific Front Door routes matching the intended domain and path patterns to origin groups. The differentiating evidence is that requests with each route pattern reach the intended origin while unmatched patterns follow the designed default.

Public origins need defenses against clients bypassing edge WAF and delivery rules. However, the option would implement apply supported origin access restrictions using Front Door identification and approved security controls; the scenario instead requires create specific Front Door routes matching the intended domain and path patterns to origin groups. The differentiating evidence is that requests with each route pattern reach the intended origin while unmatched patterns follow the designed default.

Frontend TLS termination does not automatically encrypt the independent gateway-to-backend connection. However, the option would implement configure HTTPS backend settings with suitable server certificate trust and host-name handling; the scenario instead requires attach a supported Application Gateway WAF policy in the intended enforcement mode. The differentiating evidence is that an approved safe test payload produces a matching WAF log action without blocking normal transactions.

URL path maps select backend targets on HTTP path matches, with default behavior for other paths. However, the option would implement configure path-based routing rules and suitable default backend pool in Application Gateway; the scenario instead requires attach a supported Application Gateway WAF policy in the intended enforcement mode. The differentiating evidence is that an approved safe test payload produces a matching WAF log action without blocking normal transactions.

Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. However, the option would implement replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener; the scenario instead requires attach a supported Application Gateway WAF policy in the intended enforcement mode. The differentiating evidence is that an approved safe test payload produces a matching WAF log action without blocking normal transactions.

Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. However, the option would implement place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets; the scenario instead requires provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway. The differentiating evidence is that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

Bring-your-own-IP requires prefix validation and provisioning rather than treating any arbitrary public range as Azure owned. However, the option would implement use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs; the scenario instead requires provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway. The differentiating evidence is that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. However, the option would implement reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility; the scenario instead requires provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway. The differentiating evidence is that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. However, the option would implement create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers; the scenario instead requires refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings. The differentiating evidence is that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. However, the option would implement enable autoregistration for the appropriate VNet link to an Azure Private DNS zone; the scenario instead requires refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings. The differentiating evidence is that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

Ruleset links determine which VNets apply the conditional forwarding rules; peering alone is insufficient. However, the option would implement link the intended spoke VNet to the appropriate DNS forwarding ruleset; the scenario instead requires refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings. The differentiating evidence is that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

Attack path analysis evaluates connected weaknesses rather than treating each network setting in isolation. However, the option would implement use Defender for Cloud attack path analysis to identify exploitable exposure chains; the scenario instead requires route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. The differentiating evidence is that the analyst retrieves a time-bounded flow record for a representative deny and validates source and destination fields.

VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. However, the option would implement enable supported VNet flow logs with the intended storage and analysis configuration; the scenario instead requires route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. The differentiating evidence is that the analyst retrieves a time-bounded flow record for a representative deny and validates source and destination fields.

Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. However, the option would implement use Defender for Cloud Cloud Security Explorer to query related security posture resources; the scenario instead requires route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. The differentiating evidence is that the analyst retrieves a time-bounded flow record for a representative deny and validates source and destination fields.

Front Door origin selection depends on health probes and configured origin priority or weight. However, the option would implement configure Front Door origin-group health probes and suitable priority or weight settings; the scenario instead requires deploy Azure Front Door with appropriate origin groups and endpoint routes. The differentiating evidence is that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. However, the option would implement use supported Front Door rules and geographic filtering where appropriate, plus origin segregation; the scenario instead requires deploy Azure Front Door with appropriate origin groups and endpoint routes. The differentiating evidence is that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

Front Door cache purging invalidates stale edge copies in supported scopes. However, the option would implement use the supported Front Door purge cache operation for affected URL patterns; the scenario instead requires deploy Azure Front Door with appropriate origin groups and endpoint routes. The differentiating evidence is that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

That observation would primarily validate another control: configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. The situation calls for evidence that the contracted connectivity provider provisions the selected handoff and the circuit enters a usable state.

That observation would primarily validate another control: use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. BFD can detect forwarding failures rapidly and inform BGP convergence where supported. The situation calls for evidence that the contracted connectivity provider provisions the selected handoff and the circuit enters a usable state.

That observation would primarily validate another control: add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate. A private transport path is not inherently end-to-end payload encryption for compliance purposes. The situation calls for evidence that the contracted connectivity provider provisions the selected handoff and the circuit enters a usable state.

That observation would primarily validate another control: configure a DNAT rule with the intended public destination, private target and matching security controls. Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. The situation calls for evidence that an approved test deny yields a searchable event with source, destination and matching policy details.

That observation would primarily validate another control: correlate firewall decision logs with source and destination effective routes and return connectivity. A rule allow is not sufficient when a request or response never passes the expected firewall path. The situation calls for evidence that an approved test deny yields a searchable event with source, destination and matching policy details.

That observation would primarily validate another control: associate the required UDR and validate effective routes across every protected workload subnet. Azure Firewall cannot inspect flows that routing directs around its data path. The situation calls for evidence that an approved test deny yields a searchable event with source, destination and matching policy details.