That observation would primarily validate another control: enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. The situation calls for evidence that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

That observation would primarily validate another control: configure HTTPS backend settings with suitable server certificate trust and host-name handling. Frontend TLS termination does not automatically encrypt the independent gateway-to-backend connection. The situation calls for evidence that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

That observation would primarily validate another control: configure a custom Application Gateway health probe with the correct host header, protocol and probe path. Gateway backend health uses probe settings that must match the application's listener and host expectations. The situation calls for evidence that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

That observation would primarily validate another control: create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints. Inbound and outbound resolver endpoints use dedicated subnets that cannot host unrelated workloads. The situation calls for evidence that a query to public recursive resolvers returns the delegated Azure DNS answer for the test hostname.

That observation would primarily validate another control: plan internal private DNS zones and public DNS hosting as distinct authoritative resolution scopes. Public Azure DNS zones and private DNS zones have different visibility and delegation semantics. The situation calls for evidence that a query to public recursive resolvers returns the delegated Azure DNS answer for the test hostname.

That observation would primarily validate another control: deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP. The inbound endpoint accepts hybrid DNS queries and can resolve private zones linked to its VNet. The situation calls for evidence that a query to public recursive resolvers returns the delegated Azure DNS answer for the test hostname.

A service endpoint is a VNet subnet property and does not directly make arbitrary branch source IPs part of that subnet. However, the option would implement use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required; the scenario instead requires use a private endpoint instead of a service endpoint for private-IP service access. The differentiating evidence is that the client resolves to a private endpoint IP and public service network access is disabled.

Service endpoint policies can narrow egress to supported Azure service resources rather than all accounts. However, the option would implement apply supported service endpoint policies with the authorized storage resource definitions; the scenario instead requires use a private endpoint instead of a service endpoint for private-IP service access. The differentiating evidence is that the client resolves to a private endpoint IP and public service network access is disabled.

Service endpoints do not change a service FQDN into a consumer private endpoint address. However, the option would implement keep normal public service DNS and validate service endpoint route and subnet network-rule behavior; the scenario instead requires use a private endpoint instead of a service endpoint for private-IP service access. The differentiating evidence is that the client resolves to a private endpoint IP and public service network access is disabled.

That observation would primarily validate another control: inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. The situation calls for evidence that iP flow verify reports the intended private-address rule and the internal application test passes.

That observation would primarily validate another control: correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. The situation calls for evidence that iP flow verify reports the intended private-address rule and the internal application test passes.

That observation would primarily validate another control: enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment. New NSG flow logs are no longer supported; VNet flow logs are the recommended replacement. The situation calls for evidence that iP flow verify reports the intended private-address rule and the internal application test passes.

That observation would primarily validate another control: create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. The situation calls for evidence that the effective rule analysis identifies the controlling deny and the permitted test passes after approved changes.

That observation would primarily validate another control: use Network Watcher connection testing and IP flow verify alongside service listener checks. A missing application log can result from network filtering or an unavailable listener; both need evidence. The situation calls for evidence that the effective rule analysis identifies the controlling deny and the permitted test passes after approved changes.

That observation would primarily validate another control: associate the NSG with the actual target subnet or network interface and validate effective policy. An unattached NSG does not evaluate workload traffic merely because its resource exists. The situation calls for evidence that the effective rule analysis identifies the controlling deny and the permitted test passes after approved changes.

That observation would primarily validate another control: provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway. Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. The situation calls for evidence that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

That observation would primarily validate another control: plan address-space updates with peering synchronization and dependency validation before routing cutover. Connected peers and gateways must recognize updated prefixes and traffic cannot rely on stale addressing during migration. The situation calls for evidence that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

That observation would primarily validate another control: associate a supported static public IP resource with the correct VM network interface configuration. A standalone VM public IP attachment belongs to a NIC IP configuration and a static allocation preserves its address. The situation calls for evidence that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. However, the option would implement use supported Front Door rules and geographic filtering where appropriate, plus origin segregation; the scenario instead requires complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. The differentiating evidence is that the hostname resolves to Front Door and an external client negotiates TLS with its correct certificate.

Public origins need defenses against clients bypassing edge WAF and delivery rules. However, the option would implement apply supported origin access restrictions using Front Door identification and approved security controls; the scenario instead requires complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. The differentiating evidence is that the hostname resolves to Front Door and an external client negotiates TLS with its correct certificate.

Edge origin health assessment should use a consistently reachable probe without costly application side effects. However, the option would implement configure an appropriate lightweight unauthenticated Front Door origin health probe path; the scenario instead requires complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. The differentiating evidence is that the hostname resolves to Front Door and an external client negotiates TLS with its correct certificate.

That observation would primarily validate another control: verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately. Moving to Private Link requires validating both name resolution and authorization before retiring former service access. The situation calls for evidence that the client resolves to a private endpoint IP and public service network access is disabled.

That observation would primarily validate another control: enable the supported service endpoint on each specific subnet that requires the Azure service network identity. Service endpoints are configured at subnet level, not automatically across an entire VNet. The situation calls for evidence that the client resolves to a private endpoint IP and public service network access is disabled.

That observation would primarily validate another control: choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. The situation calls for evidence that the client resolves to a private endpoint IP and public service network access is disabled.

That observation would primarily validate another control: plan address-space updates with peering synchronization and dependency validation before routing cutover. Connected peers and gateways must recognize updated prefixes and traffic cannot rely on stale addressing during migration. The situation calls for evidence that the managed firewall instance provisions successfully in the reserved subnet and receives its intended private IP.

That observation would primarily validate another control: choose the service-supported delegated subnet and remove incompatible delegation or workload placements. Subnet delegation is scoped to supported service providers and imposes placement constraints. The situation calls for evidence that the managed firewall instance provisions successfully in the reserved subnet and receives its intended private IP.

That observation would primarily validate another control: use private backend addressing and implement egress separately through a controlled outbound path. Outbound connectivity does not require each backend NIC to carry a public address or accept inbound traffic. The situation calls for evidence that the managed firewall instance provisions successfully in the reserved subnet and receives its intended private IP.

Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. However, the option would implement use supported Front Door rules and geographic filtering where appropriate, plus origin segregation; the scenario instead requires associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns. The differentiating evidence is that a permitted benign request succeeds and an approved safe WAF test produces a matching edge policy action.

Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. However, the option would implement complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate; the scenario instead requires associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns. The differentiating evidence is that a permitted benign request succeeds and an approved safe WAF test produces a matching edge policy action.

Front Door is a globally distributed application delivery service that proxies and routes HTTP(S) traffic to healthy origins. However, the option would implement deploy Azure Front Door with appropriate origin groups and endpoint routes; the scenario instead requires associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns. The differentiating evidence is that a permitted benign request succeeds and an approved safe WAF test produces a matching edge policy action.

An HTTP-to-HTTPS redirect moves the client to a TLS endpoint rather than serving sensitive content over HTTP. However, the option would implement configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway; the scenario instead requires configure supported internal and public frontend IP configurations and bind listeners to the intended frontend. The differentiating evidence is that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. However, the option would implement add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing; the scenario instead requires configure supported internal and public frontend IP configurations and bind listeners to the intended frontend. The differentiating evidence is that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. However, the option would implement enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings; the scenario instead requires configure supported internal and public frontend IP configurations and bind listeners to the intended frontend. The differentiating evidence is that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.