That observation would primarily validate another control: create Front Door rules for supported redirect or URL rewrite behavior on the matching route. Front Door rules can modify edge request handling before forwarding to origin services. The situation calls for evidence that repeated public asset requests show cache hits while authenticated account responses are not cached.

That observation would primarily validate another control: approve the required private endpoint connection and verify the origin's private link health. Private Link origin connectivity requires accepted connection state and valid private endpoint/DNS behavior. The situation calls for evidence that repeated public asset requests show cache hits while authenticated account responses are not cached.

That observation would primarily validate another control: create specific Front Door routes matching the intended domain and path patterns to origin groups. A route connects domain/path matching with the origin group and forwarding behavior. The situation calls for evidence that repeated public asset requests show cache hits while authenticated account responses are not cached.

Private Link for multi-service resources may have different endpoint group IDs and DNS zones. However, the option would implement create the needed private endpoints and matching DNS zones for each required supported storage subresource; the scenario instead requires review and configure supported private endpoint network policies and the associated subnet routes deliberately. The differentiating evidence is that a representative approved flow reaches the endpoint through the intended path and denied flows are blocked.

Private endpoints map a supported PaaS service into a VNet through a private network interface. However, the option would implement create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration; the scenario instead requires review and configure supported private endpoint network policies and the associated subnet routes deliberately. The differentiating evidence is that a representative approved flow reaches the endpoint through the intended path and denied flows are blocked.

Private DNS zone visibility follows VNet links and resolution architecture, not merely peering topology. However, the option would implement plan consistent private DNS zone links or resolver forwarding across the client VNets; the scenario instead requires review and configure supported private endpoint network policies and the associated subnet routes deliberately. The differentiating evidence is that a representative approved flow reaches the endpoint through the intended path and denied flows are blocked.

That observation would primarily validate another control: create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. Private endpoints map a supported PaaS service into a VNet through a private network interface. The situation calls for evidence that a permitted identity in an approved network succeeds and a denied identity or network cannot perform the protected operation.

That observation would primarily validate another control: check resource-specific Private Link support, subresource group IDs and regional availability before implementation. Private endpoint connectivity depends on the destination service's supported private link capabilities. The situation calls for evidence that a permitted identity in an approved network succeeds and a denied identity or network cannot perform the protected operation.

That observation would primarily validate another control: link the correct service-specific private DNS zone to the client VNet and verify A-record resolution. Private Link endpoint creation does not guarantee client DNS queries return the private IP. The situation calls for evidence that a permitted identity in an approved network succeeds and a denied identity or network cannot perform the protected operation.

Probe-driven backend health prevents new flows from being distributed to failing endpoints. However, the option would implement configure appropriate Load Balancer probe and rollout health gating for backend readiness; the scenario instead requires adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. The differentiating evidence is that after the TTL window, fresh queries resolve to the healthy selected endpoint and the standby service responds.

Load balancing applies only to members registered in its backend pool and passing health checks. However, the option would implement register eligible NIC IP configurations or supported resources in the load balancer backend pool; the scenario instead requires adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. The differentiating evidence is that after the TTL window, fresh queries resolve to the healthy selected endpoint and the standby service responds.

Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. However, the option would implement configure suitable load-balancing rules including HA ports where the chosen internal design supports them; the scenario instead requires adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. The differentiating evidence is that after the TTL window, fresh queries resolve to the healthy selected endpoint and the standby service responds.

That observation would primarily validate another control: correct Virtual WAN route table associations and propagation labels for the connected networks. Virtual hub routing depends on the association and propagation configuration of each connection. The situation calls for evidence that measured throughput and concurrent connection counts remain within capacity under representative load.

That observation would primarily validate another control: deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. The situation calls for evidence that measured throughput and concurrent connection counts remain within capacity under representative load.

That observation would primarily validate another control: deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections. Virtual WAN Standard supports centralized hub routing and expanded branch/VNet connectivity services. The situation calls for evidence that measured throughput and concurrent connection counts remain within capacity under representative load.

That observation would primarily validate another control: choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning. Cloud exchange, point-to-point and other provider models have different operational and physical requirements. The situation calls for evidence that the two target regions can attach through the designed service and verify permitted test traffic.

That observation would primarily validate another control: add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate. A private transport path is not inherently end-to-end payload encryption for compliance purposes. The situation calls for evidence that the two target regions can attach through the designed service and verify permitted test traffic.

That observation would primarily validate another control: design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections. Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. The situation calls for evidence that the two target regions can attach through the designed service and verify permitted test traffic.

That observation would primarily validate another control: reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants. Azure Firewall provisioning requires its reserved subnet and adequate address capacity. The situation calls for evidence that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

That observation would primarily validate another control: review Firewall Policy rule-collection-group and collection processing order and correct priorities. Azure Firewall policy evaluation order and processing rules determine which matching decision applies. The situation calls for evidence that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

That observation would primarily validate another control: use supported Azure Firewall FQDN tags or service-aware policy features where applicable. Managed service and FQDN tags reduce brittle static destination-IP maintenance for supported services. The situation calls for evidence that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

Service endpoint policies can narrow egress to supported Azure service resources rather than all accounts. However, the option would implement apply supported service endpoint policies with the authorized storage resource definitions; the scenario instead requires allow the intended service-tag destination and necessary outbound flow in subnet security controls. The differentiating evidence is that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. However, the option would implement choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing; the scenario instead requires allow the intended service-tag destination and necessary outbound flow in subnet security controls. The differentiating evidence is that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

Service endpoints do not change a service FQDN into a consumer private endpoint address. However, the option would implement keep normal public service DNS and validate service endpoint route and subnet network-rule behavior; the scenario instead requires allow the intended service-tag destination and necessary outbound flow in subnet security controls. The differentiating evidence is that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. However, the option would implement use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources; the scenario instead requires choose the service-supported delegated subnet and remove incompatible delegation or workload placements. The differentiating evidence is that the configured service is accepted by the subnet and deployment validation no longer reports delegation conflicts.

IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. However, the option would implement add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends; the scenario instead requires choose the service-supported delegated subnet and remove incompatible delegation or workload placements. The differentiating evidence is that the configured service is accepted by the subnet and deployment validation no longer reports delegation conflicts.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires choose the service-supported delegated subnet and remove incompatible delegation or workload placements. The differentiating evidence is that the configured service is accepted by the subnet and deployment validation no longer reports delegation conflicts.

Private endpoint NSG and UDR enforcement depends on subnet network policy configuration. However, the option would implement configure supported private endpoint network-policy settings and relevant NSG rules where enabled; the scenario instead requires enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment. The differentiating evidence is that a test east-west flow produces the expected VNet flow record in the selected log destination.

ASGs identify groups of NICs for rule targets without hard-coding changing workload IPs. However, the option would implement create an application security group and reference it in supported NSG rules for member network interfaces; the scenario instead requires enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment. The differentiating evidence is that a test east-west flow produces the expected VNet flow record in the selected log destination.

NSG policy evaluation sees packet addresses at its network scope rather than assuming Internet NAT addresses. However, the option would implement match NSG rules to the effective private source and destination packet addresses at the NIC boundary; the scenario instead requires enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment. The differentiating evidence is that a test east-west flow produces the expected VNet flow record in the selected log destination.

That observation would primarily validate another control: constrain client routing and enforce destination access with NSGs and identity-aware controls. P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. The situation calls for evidence that a freshly configured client imports the new profile and reaches the expected VNet resources.

That observation would primarily validate another control: choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. P2S tunnel protocol support varies by gateway settings and VPN client platform. The situation calls for evidence that a freshly configured client imports the new profile and reaches the expected VNet resources.

That observation would primarily validate another control: assign a distinct nonoverlapping P2S client address pool and republish the client configuration. Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. The situation calls for evidence that a freshly configured client imports the new profile and reaches the expected VNet resources.