FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants. The differentiating evidence is that the firewall provisions successfully and its health and data-plane traffic meet deployment checks.

Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. However, the option would implement use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance; the scenario instead requires reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants. The differentiating evidence is that the firewall provisions successfully and its health and data-plane traffic meet deployment checks.

Azure Firewall policy evaluation order and processing rules determine which matching decision applies. However, the option would implement review Firewall Policy rule-collection-group and collection processing order and correct priorities; the scenario instead requires reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants. The differentiating evidence is that the firewall provisions successfully and its health and data-plane traffic meet deployment checks.

That observation would primarily validate another control: scope and associate appropriate WAF security policies to supported domains or path patterns. WAF policy association and custom rule match conditions determine where application-layer controls apply. The situation calls for evidence that a controlled test shows the intended enforcement layer with consistent logged request identifiers.

That observation would primarily validate another control: apply a narrowly scoped WAF exclusion or supported per-rule override instead of disabling all protection. Targeted tuning preserves the broader managed rule set while addressing a justified false positive. The situation calls for evidence that a controlled test shows the intended enforcement layer with consistent logged request identifiers.

That observation would primarily validate another control: attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode. WAF policies inspect HTTP application requests for known attack patterns rather than replacing NSG port controls. The situation calls for evidence that a controlled test shows the intended enforcement layer with consistent logged request identifiers.

Virtual WAN supports user VPN gateways for individually authenticated client connectivity. However, the option would implement deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration; the scenario instead requires check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions. The differentiating evidence is that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

Virtual WAN supports specific managed NVA integrations and partner deployment requirements. However, the option would implement use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model; the scenario instead requires check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions. The differentiating evidence is that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

Virtual WAN Standard supports centralized hub routing and expanded branch/VNet connectivity services. However, the option would implement deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections; the scenario instead requires check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions. The differentiating evidence is that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

That observation would primarily validate another control: use WAF diagnostic logs to identify matched policy, rule and client/request details. Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. The situation calls for evidence that the frontend shows the active policy association and a representative managed-rule test is logged.

That observation would primarily validate another control: scope and associate appropriate WAF security policies to supported domains or path patterns. WAF policy association and custom rule match conditions determine where application-layer controls apply. The situation calls for evidence that the frontend shows the active policy association and a representative managed-rule test is logged.

That observation would primarily validate another control: configure supported WAF rate-limit or bot protection rules at the appropriate edge scope. WAF custom rate limits and bot controls can mitigate application-layer request floods when correctly scoped. The situation calls for evidence that the frontend shows the active policy association and a representative managed-rule test is logged.

Private endpoint connectivity depends on the destination service's supported private link capabilities. However, the option would implement check resource-specific Private Link support, subresource group IDs and regional availability before implementation; the scenario instead requires use a Private Link service with explicit connection approval and supported provider NAT configuration. The differentiating evidence is that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

Private endpoint policy support and traffic paths must be consistent with the desired inspection/segmentation design. However, the option would implement review and configure supported private endpoint network policies and the associated subnet routes deliberately; the scenario instead requires use a Private Link service with explicit connection approval and supported provider NAT configuration. The differentiating evidence is that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

Private DNS zone visibility follows VNet links and resolution architecture, not merely peering topology. However, the option would implement plan consistent private DNS zone links or resolver forwarding across the client VNets; the scenario instead requires use a Private Link service with explicit connection approval and supported provider NAT configuration. The differentiating evidence is that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires create an eligible dedicated subnet and apply the delegation required by the integrating Azure service. The differentiating evidence is that the service integration deploys into the delegated subnet and private downstream connections succeed.

Peering and hybrid routing require unambiguous destinations; overlapping prefixes prevent intended reachability. However, the option would implement allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity; the scenario instead requires create an eligible dedicated subnet and apply the delegation required by the integrating Azure service. The differentiating evidence is that the service integration deploys into the delegated subnet and private downstream connections succeed.

Azure Firewall uses a specific reserved subnet name and supported minimum capacity for deployment and scaling. However, the option would implement provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall; the scenario instead requires create an eligible dedicated subnet and apply the delegation required by the integrating Azure service. The differentiating evidence is that the service integration deploys into the delegated subnet and private downstream connections succeed.

That observation would primarily validate another control: use WAF diagnostic logs to identify matched policy, rule and client/request details. Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. The situation calls for evidence that an approved safe injection test produces a managed rule match while ordinary requests remain available.

That observation would primarily validate another control: configure supported WAF rate-limit or bot protection rules at the appropriate edge scope. WAF custom rate limits and bot controls can mitigate application-layer request floods when correctly scoped. The situation calls for evidence that an approved safe injection test produces a managed rule match while ordinary requests remain available.

That observation would primarily validate another control: start the WAF in detection mode, review matched rules and then enable prevention after tuning. Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. The situation calls for evidence that an approved safe injection test produces a managed rule match while ordinary requests remain available.

That observation would primarily validate another control: add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace. Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. The situation calls for evidence that an on-premises query through the inbound endpoint returns the expected zone record rather than NXDOMAIN.

That observation would primarily validate another control: create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints. Inbound and outbound resolver endpoints use dedicated subnets that cannot host unrelated workloads. The situation calls for evidence that an on-premises query through the inbound endpoint returns the expected zone record rather than NXDOMAIN.

That observation would primarily validate another control: create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. The situation calls for evidence that an on-premises query through the inbound endpoint returns the expected zone record rather than NXDOMAIN.

That observation would primarily validate another control: inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. Backend availability depends on probe reachability and network/security rules, not simply process existence. The situation calls for evidence that the view shows a time-aligned degradation on the affected connection and recovery after the fix.

That observation would primarily validate another control: inventory DDoS protection plan associations and protected public IP resources in governance checks. A DDoS plan or protection policy only helps resources properly associated within its supported scope. The situation calls for evidence that the view shows a time-aligned degradation on the affected connection and recovery after the fix.

That observation would primarily validate another control: collect virtual network gateway diagnostic logs and metrics into centralized monitoring. VPN disconnect and gateway events require historical telemetry, not only current status views. The situation calls for evidence that the view shows a time-aligned degradation on the affected connection and recovery after the fix.

Front Door is a globally distributed application delivery service that proxies and routes HTTP(S) traffic to healthy origins. However, the option would implement deploy Azure Front Door with appropriate origin groups and endpoint routes; the scenario instead requires use the supported Front Door purge cache operation for affected URL patterns. The differentiating evidence is that a fresh request after purge returns updated origin content rather than the old cached version.

Front Door origin selection depends on health probes and configured origin priority or weight. However, the option would implement configure Front Door origin-group health probes and suitable priority or weight settings; the scenario instead requires use the supported Front Door purge cache operation for affected URL patterns. The differentiating evidence is that a fresh request after purge returns updated origin content rather than the old cached version.

Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. However, the option would implement use Front Door Premium Private Link origin connectivity and configure compatible origin private access; the scenario instead requires use the supported Front Door purge cache operation for affected URL patterns. The differentiating evidence is that a fresh request after purge returns updated origin content rather than the old cached version.

Some Private Link connections require resource-owner approval before private traffic is accepted. However, the option would implement approve the intended private endpoint connection on the target resource before testing access; the scenario instead requires create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. The differentiating evidence is that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

Disabling the public endpoint before validating private name resolution and routes can cause an avoidable outage. However, the option would implement sequence private endpoint approval, private DNS, connectivity testing and then public network restriction; the scenario instead requires create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. The differentiating evidence is that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

Private endpoint policy support and traffic paths must be consistent with the desired inspection/segmentation design. However, the option would implement review and configure supported private endpoint network policies and the associated subnet routes deliberately; the scenario instead requires create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. The differentiating evidence is that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.