Some Private Link connections require resource-owner approval before private traffic is accepted. However, the option would implement approve the intended private endpoint connection on the target resource before testing access; the scenario instead requires create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. The differentiating evidence is that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

Disabling the public endpoint before validating private name resolution and routes can cause an avoidable outage. However, the option would implement sequence private endpoint approval, private DNS, connectivity testing and then public network restriction; the scenario instead requires create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. The differentiating evidence is that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

Private endpoint policy support and traffic paths must be consistent with the desired inspection/segmentation design. However, the option would implement review and configure supported private endpoint network policies and the associated subnet routes deliberately; the scenario instead requires create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. The differentiating evidence is that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

WAF policies inspect HTTP application requests for known attack patterns rather than replacing NSG port controls. However, the option would implement attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode; the scenario instead requires associate a Front Door WAF policy with the intended endpoint domains through a security policy. The differentiating evidence is that a safe test request triggers the documented edge action and no origin request is observed for a blocked sample.

Geographic filtering requires explicit request-based policy and should not be confused with backend origin placement. However, the option would implement define WAF custom geographic match rules or supported edge access controls for the target domains; the scenario instead requires associate a Front Door WAF policy with the intended endpoint domains through a security policy. The differentiating evidence is that a safe test request triggers the documented edge action and no origin request is observed for a blocked sample.

Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. However, the option would implement use WAF diagnostic logs to identify matched policy, rule and client/request details; the scenario instead requires associate a Front Door WAF policy with the intended endpoint domains through a security policy. The differentiating evidence is that a safe test request triggers the documented edge action and no origin request is observed for a blocked sample.

That observation would primarily validate another control: use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes. Connection troubleshoot evaluates the actual source-to-destination path rather than guessing from VM health status. The situation calls for evidence that the intended destination prefix and matching NSG allow action are visible before the application probe passes.

That observation would primarily validate another control: use Defender for Cloud attack path analysis to identify exploitable exposure chains. Attack path analysis evaluates connected weaknesses rather than treating each network setting in isolation. The situation calls for evidence that the intended destination prefix and matching NSG allow action are visible before the application probe passes.

That observation would primarily validate another control: collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes. An allow rule alone cannot establish name resolution, correct next hop and application endpoint identity. The situation calls for evidence that the intended destination prefix and matching NSG allow action are visible before the application probe passes.

That observation would primarily validate another control: configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates. The client-to-edge and edge-to-origin TLS connections are distinct and must both be configured. The situation calls for evidence that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

That observation would primarily validate another control: associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns. Front Door WAF evaluates incoming HTTP requests at the edge before routing to origins. The situation calls for evidence that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

That observation would primarily validate another control: approve the required private endpoint connection and verify the origin's private link health. Private Link origin connectivity requires accepted connection state and valid private endpoint/DNS behavior. The situation calls for evidence that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

That observation would primarily validate another control: deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes. Public Load Balancer distributes layer-4 flows across healthy backends without inspecting URL paths. The situation calls for evidence that outbound connection tests succeed at peak concurrency and the public source addresses match the plan.

That observation would primarily validate another control: configure suitable load-balancing rules including HA ports where the chosen internal design supports them. Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. The situation calls for evidence that outbound connection tests succeed at peak concurrency and the public source addresses match the plan.

That observation would primarily validate another control: configure an eligible health probe and backend listener that match the service port and NSG rules. Load Balancer health probes decide which backends are eligible for new flows. The situation calls for evidence that outbound connection tests succeed at peak concurrency and the public source addresses match the plan.

Two WAF enforcement points can both inspect requests; policy coordination reduces conflicting false positives. However, the option would implement define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers; the scenario instead requires use WAF diagnostic logs to identify matched policy, rule and client/request details. The differentiating evidence is that the analyst correlates the request ID with a specific rule and documents an approved remediation.

NSGs enforce network transport rules and do not parse application attack payloads. However, the option would implement deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters; the scenario instead requires use WAF diagnostic logs to identify matched policy, rule and client/request details. The differentiating evidence is that the analyst correlates the request ID with a specific rule and documents an approved remediation.

Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. However, the option would implement start the WAF in detection mode, review matched rules and then enable prevention after tuning; the scenario instead requires use WAF diagnostic logs to identify matched policy, rule and client/request details. The differentiating evidence is that the analyst correlates the request ID with a specific rule and documents an approved remediation.

Private endpoints do not necessarily disable a service's existing public network endpoint automatically. However, the option would implement restrict or disable the PaaS resource's public network access separately from creating its private endpoint; the scenario instead requires plan consistent private DNS zone links or resolver forwarding across the client VNets. The differentiating evidence is that test clients in every approved spoke resolve the correct endpoint IPs.

Private Link for multi-service resources may have different endpoint group IDs and DNS zones. However, the option would implement create the needed private endpoints and matching DNS zones for each required supported storage subresource; the scenario instead requires plan consistent private DNS zone links or resolver forwarding across the client VNets. The differentiating evidence is that test clients in every approved spoke resolve the correct endpoint IPs.

A provider Private Link service can expose eligible private load-balanced workloads to consumer subscriptions. However, the option would implement use a Private Link service with explicit connection approval and supported provider NAT configuration; the scenario instead requires plan consistent private DNS zone links or resolver forwarding across the client VNets. The differentiating evidence is that test clients in every approved spoke resolve the correct endpoint IPs.

That observation would primarily validate another control: review Defender for Cloud Secure Score security recommendations for network resources. Secure Score recommendations expose actionable posture findings to prioritize weak network configurations. The situation calls for evidence that the monitoring store shows timestamps and causes for a simulated or observed connection transition.

That observation would primarily validate another control: enable supported VNet flow logs with the intended storage and analysis configuration. VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. The situation calls for evidence that the monitoring store shows timestamps and causes for a simulated or observed connection transition.

That observation would primarily validate another control: compare Network Watcher effective routes and effective security rules for the affected NIC. Routing and filtering are independent controls; both must support a successful end-to-end connection. The situation calls for evidence that the monitoring store shows timestamps and causes for a simulated or observed connection transition.

That observation would primarily validate another control: evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. ExpressRoute Direct offers dedicated port pairs for creating supported ExpressRoute circuits at high scale. The situation calls for evidence that a branch-to-branch route and packet trace traverse the intended Global Reach path.

That observation would primarily validate another control: select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. The situation calls for evidence that a branch-to-branch route and packet trace traverse the intended Global Reach path.

That observation would primarily validate another control: use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. BFD can detect forwarding failures rapidly and inform BGP convergence where supported. The situation calls for evidence that a branch-to-branch route and packet trace traverse the intended Global Reach path.

Moving to Private Link requires validating both name resolution and authorization before retiring former service access. However, the option would implement verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately; the scenario instead requires enable the supported service endpoint on each specific subnet that requires the Azure service network identity. The differentiating evidence is that requests from enabled subnets match intended service rules; an unconfigured subnet remains excluded.

Service endpoint routing does not bypass independent NSG or resource firewall enforcement. However, the option would implement allow the intended service-tag destination and necessary outbound flow in subnet security controls; the scenario instead requires enable the supported service endpoint on each specific subnet that requires the Azure service network identity. The differentiating evidence is that requests from enabled subnets match intended service rules; an unconfigured subnet remains excluded.

Service endpoints do not change a service FQDN into a consumer private endpoint address. However, the option would implement keep normal public service DNS and validate service endpoint route and subnet network-rule behavior; the scenario instead requires enable the supported service endpoint on each specific subnet that requires the Azure service network identity. The differentiating evidence is that requests from enabled subnets match intended service rules; an unconfigured subnet remains excluded.

NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. However, the option would implement attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet; the scenario instead requires use Azure Route Server with a supported BGP peer to exchange routes dynamically. The differentiating evidence is that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. However, the option would implement inspect the effective-route longest-prefix match and add the proper more-specific route where supported; the scenario instead requires use Azure Route Server with a supported BGP peer to exchange routes dynamically. The differentiating evidence is that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

Control-plane connectivity and data-plane path selection must be diagnosed separately. However, the option would implement inspect peering status, route propagation and effective routes before changing security policies; the scenario instead requires use Azure Route Server with a supported BGP peer to exchange routes dynamically. The differentiating evidence is that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.