That observation would primarily validate another control: configure a DNAT rule with the intended public destination, private target and matching security controls. Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. The situation calls for evidence that an approved test deny yields a searchable event with source, destination and matching policy details.

That observation would primarily validate another control: correlate firewall decision logs with source and destination effective routes and return connectivity. A rule allow is not sufficient when a request or response never passes the expected firewall path. The situation calls for evidence that an approved test deny yields a searchable event with source, destination and matching policy details.

That observation would primarily validate another control: associate the required UDR and validate effective routes across every protected workload subnet. Azure Firewall cannot inspect flows that routing directs around its data path. The situation calls for evidence that an approved test deny yields a searchable event with source, destination and matching policy details.

That observation would primarily validate another control: review and configure supported private endpoint network policies and the associated subnet routes deliberately. Private endpoint policy support and traffic paths must be consistent with the desired inspection/segmentation design. The situation calls for evidence that the selected service and group ID validate and the endpoint connection provisions successfully.

That observation would primarily validate another control: use individual approved private endpoint connections and enforce data-plane identity authorization. DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. The situation calls for evidence that the selected service and group ID validate and the endpoint connection provisions successfully.

That observation would primarily validate another control: create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. Private endpoints map a supported PaaS service into a VNet through a private network interface. The situation calls for evidence that the selected service and group ID validate and the endpoint connection provisions successfully.

That observation would primarily validate another control: use Defender for Cloud Cloud Security Explorer to query related security posture resources. Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. The situation calls for evidence that the investigation reports the actual DNS target, path and application response and isolates the failed dependency.

That observation would primarily validate another control: inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. Backend availability depends on probe reachability and network/security rules, not simply process existence. The situation calls for evidence that the investigation reports the actual DNS target, path and application response and isolates the failed dependency.

That observation would primarily validate another control: enable supported VNet flow logs with the intended storage and analysis configuration. VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. The situation calls for evidence that the investigation reports the actual DNS target, path and application response and isolates the failed dependency.

That observation would primarily validate another control: configure an Application Gateway redirect configuration associated with the right listener or rule. HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. The situation calls for evidence that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

That observation would primarily validate another control: configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway. An HTTP-to-HTTPS redirect moves the client to a TLS endpoint rather than serving sensitive content over HTTP. The situation calls for evidence that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

That observation would primarily validate another control: configure appropriate multi-site listeners and host-based routing rules on Application Gateway. Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. The situation calls for evidence that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

That observation would primarily validate another control: associate a supported static public IP resource with the correct VM network interface configuration. A standalone VM public IP attachment belongs to a NIC IP configuration and a static allocation preserves its address. The situation calls for evidence that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

That observation would primarily validate another control: create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. The situation calls for evidence that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

That observation would primarily validate another control: allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity. Peering and hybrid routing require unambiguous destinations; overlapping prefixes prevent intended reachability. The situation calls for evidence that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

That observation would primarily validate another control: configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. The situation calls for evidence that both sides learn the expected prefixes and bidirectional TCP testing succeeds.

That observation would primarily validate another control: choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning. Cloud exchange, point-to-point and other provider models have different operational and physical requirements. The situation calls for evidence that both sides learn the expected prefixes and bidirectional TCP testing succeeds.

That observation would primarily validate another control: evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. ExpressRoute Direct offers dedicated port pairs for creating supported ExpressRoute circuits at high scale. The situation calls for evidence that both sides learn the expected prefixes and bidirectional TCP testing succeeds.

Public Load Balancer distributes layer-4 flows across healthy backends without inspecting URL paths. However, the option would implement deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes; the scenario instead requires use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers. The differentiating evidence is that a controlled region outage directs a new eligible client flow to a healthy regional backend.

Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. However, the option would implement use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing; the scenario instead requires use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers. The differentiating evidence is that a controlled region outage directs a new eligible client flow to a healthy regional backend.

Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. However, the option would implement configure Azure Traffic Manager with the correct routing method and endpoint health checks; the scenario instead requires use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers. The differentiating evidence is that a controlled region outage directs a new eligible client flow to a healthy regional backend.

That observation would primarily validate another control: refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings. Existing workloads may retain DNS settings obtained before a VNet-level resolver change. The situation calls for evidence that a trace of a controlled lookup shows one resolution path without recursive forwarding or timeout.

That observation would primarily validate another control: separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. Name resolution visibility is determined by private-zone linking and namespace selection. The situation calls for evidence that a trace of a controlled lookup shows one resolution path without recursive forwarding or timeout.

That observation would primarily validate another control: apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. DNS-layer policy can block known malicious domains without treating an IP firewall allow rule as DNS security. The situation calls for evidence that a trace of a controlled lookup shows one resolution path without recursive forwarding or timeout.

Load Balancer health probes decide which backends are eligible for new flows. However, the option would implement configure an eligible health probe and backend listener that match the service port and NSG rules; the scenario instead requires configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules. The differentiating evidence is that outbound connection tests succeed at peak concurrency and the public source addresses match the plan.

Public Load Balancer distributes layer-4 flows across healthy backends without inspecting URL paths. However, the option would implement deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes; the scenario instead requires configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules. The differentiating evidence is that outbound connection tests succeed at peak concurrency and the public source addresses match the plan.

Weighted Traffic Manager policies influence DNS answer distribution across eligible healthy endpoints. However, the option would implement configure Traffic Manager Weighted routing across the regional endpoints; the scenario instead requires configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules. The differentiating evidence is that outbound connection tests succeed at peak concurrency and the public source addresses match the plan.

Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. However, the option would implement select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication; the scenario instead requires review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes. The differentiating evidence is that the client route table includes intended branch prefixes and an approved test port works end-to-end.

Always On VPN is a client-side management design with specific tunnel and infrastructure requirements. However, the option would implement validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration; the scenario instead requires review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes. The differentiating evidence is that the client route table includes intended branch prefixes and an approved test port works end-to-end.

Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. However, the option would implement configure P2S root certificate trust and issue valid client certificates from the approved CA; the scenario instead requires review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes. The differentiating evidence is that the client route table includes intended branch prefixes and an approved test port works end-to-end.

Peering and hybrid routing require unambiguous destinations; overlapping prefixes prevent intended reachability. However, the option would implement allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity; the scenario instead requires add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. The differentiating evidence is that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. However, the option would implement create purpose-specific subnets in the VNet and apply matching network security and routing controls; the scenario instead requires add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. The differentiating evidence is that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. However, the option would implement create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet; the scenario instead requires add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. The differentiating evidence is that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.