That observation would primarily validate another control: create an Azure Firewall application rule scoped to the required FQDN and protocol. Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. The situation calls for evidence that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

That observation would primarily validate another control: use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. The situation calls for evidence that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

That observation would primarily validate another control: use supported Azure Firewall FQDN tags or service-aware policy features where applicable. Managed service and FQDN tags reduce brittle static destination-IP maintenance for supported services. The situation calls for evidence that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

NSGs enforce network transport rules and do not parse application attack payloads. However, the option would implement deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters; the scenario instead requires configure supported WAF rate-limit or bot protection rules at the appropriate edge scope. The differentiating evidence is that a controlled burst triggers the intended policy while ordinary client traffic is permitted.

Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. However, the option would implement use WAF diagnostic logs to identify matched policy, rule and client/request details; the scenario instead requires configure supported WAF rate-limit or bot protection rules at the appropriate edge scope. The differentiating evidence is that a controlled burst triggers the intended policy while ordinary client traffic is permitted.

Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. However, the option would implement start the WAF in detection mode, review matched rules and then enable prevention after tuning; the scenario instead requires configure supported WAF rate-limit or bot protection rules at the appropriate edge scope. The differentiating evidence is that a controlled burst triggers the intended policy while ordinary client traffic is permitted.

That observation would primarily validate another control: select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. The situation calls for evidence that a controlled primary-path outage retains a functional alternate route for the required workload.

That observation would primarily validate another control: match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters. Private peering is a BGP arrangement and cannot establish with inconsistent peer identifiers or IP addressing. The situation calls for evidence that a controlled primary-path outage retains a functional alternate route for the required workload.

That observation would primarily validate another control: configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. The situation calls for evidence that a controlled primary-path outage retains a functional alternate route for the required workload.

That observation would primarily validate another control: configure an Application Gateway redirect configuration associated with the right listener or rule. HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. The situation calls for evidence that a gateway-origin connection negotiates TLS with the intended hostname and the backend remains healthy.

That observation would primarily validate another control: attach a supported Application Gateway WAF policy in the intended enforcement mode. Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. The situation calls for evidence that a gateway-origin connection negotiates TLS with the intended hostname and the backend remains healthy.

That observation would primarily validate another control: configure appropriate multi-site listeners and host-based routing rules on Application Gateway. Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. The situation calls for evidence that a gateway-origin connection negotiates TLS with the intended hostname and the backend remains healthy.

That observation would primarily validate another control: associate a Front Door WAF policy with the intended endpoint domains through a security policy. Front Door WAF applies application-layer filtering at the Microsoft edge for protected routes. The situation calls for evidence that approved test requests produce WAF logs in detection and are appropriately blocked in prevention after tuning.

That observation would primarily validate another control: associate the WAF policy to the intended Application Gateway scope, listener or route as supported. A standalone policy object does not inspect traffic until attached to an applicable gateway scope. The situation calls for evidence that approved test requests produce WAF logs in detection and are appropriately blocked in prevention after tuning.

That observation would primarily validate another control: review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence. Managed rule set versions can change match behavior and should be tested against legitimate traffic. The situation calls for evidence that approved test requests produce WAF logs in detection and are appropriately blocked in prevention after tuning.

That observation would primarily validate another control: adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. The situation calls for evidence that dNS answers choose an eligible healthy endpoint and switch after a controlled failure within expected TTL behavior.

That observation would primarily validate another control: configure appropriate Load Balancer probe and rollout health gating for backend readiness. Probe-driven backend health prevents new flows from being distributed to failing endpoints. The situation calls for evidence that dNS answers choose an eligible healthy endpoint and switch after a controlled failure within expected TTL behavior.

That observation would primarily validate another control: configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules. High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. The situation calls for evidence that dNS answers choose an eligible healthy endpoint and switch after a controlled failure within expected TTL behavior.

That observation would primarily validate another control: route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS. Private endpoints can serve on-premises clients when DNS and private routing to the VNet are established. The situation calls for evidence that the selected service and group ID validate and the endpoint connection provisions successfully.

That observation would primarily validate another control: restrict or disable the PaaS resource's public network access separately from creating its private endpoint. Private endpoints do not necessarily disable a service's existing public network endpoint automatically. The situation calls for evidence that the selected service and group ID validate and the endpoint connection provisions successfully.

That observation would primarily validate another control: approve the intended private endpoint connection on the target resource before testing access. Some Private Link connections require resource-owner approval before private traffic is accepted. The situation calls for evidence that the selected service and group ID validate and the endpoint connection provisions successfully.

That observation would primarily validate another control: add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate. A private transport path is not inherently end-to-end payload encryption for compliance purposes. The situation calls for evidence that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

That observation would primarily validate another control: evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. ExpressRoute Direct offers dedicated port pairs for creating supported ExpressRoute circuits at high scale. The situation calls for evidence that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

That observation would primarily validate another control: design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections. Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. The situation calls for evidence that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

Service endpoint routing does not bypass independent NSG or resource firewall enforcement. However, the option would implement allow the intended service-tag destination and necessary outbound flow in subnet security controls; the scenario instead requires enable an appropriate virtual network service endpoint and allow the subnet in the service firewall. The differentiating evidence is that the allowed subnet accesses the service while a disallowed VNet source is rejected by resource network rules.

Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. However, the option would implement use a private endpoint instead of a service endpoint for private-IP service access; the scenario instead requires enable an appropriate virtual network service endpoint and allow the subnet in the service firewall. The differentiating evidence is that the allowed subnet accesses the service while a disallowed VNet source is rejected by resource network rules.

Network allow lists and data-plane authorization are independent controls. However, the option would implement combine service endpoint network rules with proper service authentication and RBAC or access policies; the scenario instead requires enable an appropriate virtual network service endpoint and allow the subnet in the service firewall. The differentiating evidence is that the allowed subnet accesses the service while a disallowed VNet source is rejected by resource network rules.

That observation would primarily validate another control: associate the NSG with the actual target subnet or network interface and validate effective policy. An unattached NSG does not evaluate workload traffic merely because its resource exists. The situation calls for evidence that iP flow verify reports the intended private-address rule and the internal application test passes.

That observation would primarily validate another control: apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. NSGs filter packet tuples at subnet or NIC scope and can restrict access by source, destination, port and protocol. The situation calls for evidence that iP flow verify reports the intended private-address rule and the internal application test passes.

That observation would primarily validate another control: check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies. Both subnet and NIC security groups participate in evaluating traffic, so one permissive rule is insufficient. The situation calls for evidence that iP flow verify reports the intended private-address rule and the internal application test passes.

That observation would primarily validate another control: enable appropriate forwarded traffic settings on the relevant peering connections and retain correct return routes. Traffic forwarded by an NVA requires compatible peering settings as well as layer-3 routing. The situation calls for evidence that packet captures on both sides show request and response traversing the expected inspection point.

That observation would primarily validate another control: deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. Centralized change definitions make route and topology deviations detectable before deployment. The situation calls for evidence that packet captures on both sides show request and response traversing the expected inspection point.

That observation would primarily validate another control: configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. The situation calls for evidence that packet captures on both sides show request and response traversing the expected inspection point.