That observation would primarily validate another control: combine service endpoint network rules with proper service authentication and RBAC or access policies. Network allow lists and data-plane authorization are independent controls. The situation calls for evidence that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

That observation would primarily validate another control: apply supported service endpoint policies with the authorized storage resource definitions. Service endpoint policies can narrow egress to supported Azure service resources rather than all accounts. The situation calls for evidence that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

That observation would primarily validate another control: add the selected VNet/subnet to the target service's virtual network access rules. Service endpoint enablement alone does not grant access at the PaaS service network policy layer. The situation calls for evidence that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

That observation would primarily validate another control: deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit. An ExpressRoute circuit alone is not a VNet-to-circuit connection without the gateway or supported architecture. The situation calls for evidence that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

That observation would primarily validate another control: match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters. Private peering is a BGP arrangement and cannot establish with inconsistent peer identifiers or IP addressing. The situation calls for evidence that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

That observation would primarily validate another control: add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate. A private transport path is not inherently end-to-end payload encryption for compliance purposes. The situation calls for evidence that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

That observation would primarily validate another control: choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost. Basic, Standard and Premium tiers have different security capabilities and capacity. The situation calls for evidence that a permitted destination is reachable and an unauthorized FQDN is blocked with an identifiable firewall log.

That observation would primarily validate another control: configure a DNAT rule with the intended public destination, private target and matching security controls. Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. The situation calls for evidence that a permitted destination is reachable and an unauthorized FQDN is blocked with an identifiable firewall log.

That observation would primarily validate another control: create an Azure Firewall application rule scoped to the required FQDN and protocol. Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. The situation calls for evidence that a permitted destination is reachable and an unauthorized FQDN is blocked with an identifiable firewall log.

Private endpoints do not necessarily disable a service's existing public network endpoint automatically. However, the option would implement restrict or disable the PaaS resource's public network access separately from creating its private endpoint; the scenario instead requires plan consistent private DNS zone links or resolver forwarding across the client VNets. The differentiating evidence is that test clients in every approved spoke resolve the correct endpoint IPs.

Private endpoints map a supported PaaS service into a VNet through a private network interface. However, the option would implement create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration; the scenario instead requires plan consistent private DNS zone links or resolver forwarding across the client VNets. The differentiating evidence is that test clients in every approved spoke resolve the correct endpoint IPs.

A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. However, the option would implement provide separate approved private endpoints for each consumer to the shared eligible Private Link service; the scenario instead requires plan consistent private DNS zone links or resolver forwarding across the client VNets. The differentiating evidence is that test clients in every approved spoke resolve the correct endpoint IPs.

VPN disconnect and gateway events require historical telemetry, not only current status views. However, the option would implement collect virtual network gateway diagnostic logs and metrics into centralized monitoring; the scenario instead requires inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. The differentiating evidence is that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

A DDoS plan or protection policy only helps resources properly associated within its supported scope. However, the option would implement inventory DDoS protection plan associations and protected public IP resources in governance checks; the scenario instead requires inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. The differentiating evidence is that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

Aggregated network views connect resource health and relevant network signals for operations analysis. However, the option would implement use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends; the scenario instead requires inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. The differentiating evidence is that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

That observation would primarily validate another control: correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. The situation calls for evidence that only the named approved source can open the management or database port while unapproved sources are denied.

That observation would primarily validate another control: use the appropriate Azure service tag for supported NSG destination restrictions. Azure service tags abstract changing Azure service address ranges in network security rules. The situation calls for evidence that only the named approved source can open the management or database port while unapproved sources are denied.

That observation would primarily validate another control: use Network Watcher connection testing and IP flow verify alongside service listener checks. A missing application log can result from network filtering or an unavailable listener; both need evidence. The situation calls for evidence that only the named approved source can open the management or database port while unapproved sources are denied.

That observation would primarily validate another control: place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets. Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. The situation calls for evidence that the allocated public IP resources fall inside the reserved prefix and attach to intended front-end resources.

That observation would primarily validate another control: create purpose-specific subnets in the VNet and apply matching network security and routing controls. VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. The situation calls for evidence that the allocated public IP resources fall inside the reserved prefix and attach to intended front-end resources.

That observation would primarily validate another control: reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility. Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. The situation calls for evidence that the allocated public IP resources fall inside the reserved prefix and attach to intended front-end resources.

Private endpoint connectivity depends on the destination service's supported private link capabilities. However, the option would implement check resource-specific Private Link support, subresource group IDs and regional availability before implementation; the scenario instead requires link the correct service-specific private DNS zone to the client VNet and verify A-record resolution. The differentiating evidence is that the service FQDN resolves to the private endpoint IP and a client connects successfully.

A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. However, the option would implement provide separate approved private endpoints for each consumer to the shared eligible Private Link service; the scenario instead requires link the correct service-specific private DNS zone to the client VNet and verify A-record resolution. The differentiating evidence is that the service FQDN resolves to the private endpoint IP and a client connects successfully.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires link the correct service-specific private DNS zone to the client VNet and verify A-record resolution. The differentiating evidence is that the service FQDN resolves to the private endpoint IP and a client connects successfully.

Cloud exchange, point-to-point and other provider models have different operational and physical requirements. However, the option would implement choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning; the scenario instead requires enable ExpressRoute FastPath on compatible circuits, gateways and network resources. The differentiating evidence is that a supported traffic flow follows the optimized path and meets measured throughput requirements.

Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. However, the option would implement design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections; the scenario instead requires enable ExpressRoute FastPath on compatible circuits, gateways and network resources. The differentiating evidence is that a supported traffic flow follows the optimized path and meets measured throughput requirements.

ExpressRoute reachability depends on the prefixes exchanged through established peering sessions. However, the option would implement correct BGP route advertisements and filters so the desired prefixes propagate in both directions; the scenario instead requires enable ExpressRoute FastPath on compatible circuits, gateways and network resources. The differentiating evidence is that a supported traffic flow follows the optimized path and meets measured throughput requirements.

That observation would primarily validate another control: review Defender for Cloud Secure Score security recommendations for network resources. Secure Score recommendations expose actionable posture findings to prioritize weak network configurations. The situation calls for evidence that a safe degraded-link test or monitored incident triggers the expected alert with affected resource context.

That observation would primarily validate another control: enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs. DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. The situation calls for evidence that a safe degraded-link test or monitored incident triggers the expected alert with affected resource context.

That observation would primarily validate another control: collect virtual network gateway diagnostic logs and metrics into centralized monitoring. VPN disconnect and gateway events require historical telemetry, not only current status views. The situation calls for evidence that a safe degraded-link test or monitored incident triggers the expected alert with affected resource context.

NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. However, the option would implement combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth; the scenario instead requires use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. The differentiating evidence is that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. The differentiating evidence is that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. However, the option would implement create an Azure Firewall application rule scoped to the required FQDN and protocol; the scenario instead requires use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. The differentiating evidence is that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.