That observation would primarily validate another control: use Network Watcher connectivity testing and route diagnostics from a representative Azure source. Healthy connection resources do not prove application reachability across security and routing boundaries. The situation calls for evidence that the monitoring store shows timestamps and causes for a simulated or observed connection transition.

That observation would primarily validate another control: inventory DDoS protection plan associations and protected public IP resources in governance checks. A DDoS plan or protection policy only helps resources properly associated within its supported scope. The situation calls for evidence that the monitoring store shows timestamps and causes for a simulated or observed connection transition.

That observation would primarily validate another control: use Defender for Cloud Cloud Security Explorer to query related security posture resources. Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. The situation calls for evidence that the monitoring store shows timestamps and causes for a simulated or observed connection transition.

Private endpoint policy support and traffic paths must be consistent with the desired inspection/segmentation design. However, the option would implement review and configure supported private endpoint network policies and the associated subnet routes deliberately; the scenario instead requires provide separate approved private endpoints for each consumer to the shared eligible Private Link service. The differentiating evidence is that each consumer connects through its assigned local private address without overlapping network route conflicts.

DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. However, the option would implement use individual approved private endpoint connections and enforce data-plane identity authorization; the scenario instead requires provide separate approved private endpoints for each consumer to the shared eligible Private Link service. The differentiating evidence is that each consumer connects through its assigned local private address without overlapping network route conflicts.

Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. However, the option would implement publish only the eligible Private Link service target with appropriate access policy rather than VNet peering; the scenario instead requires provide separate approved private endpoints for each consumer to the shared eligible Private Link service. The differentiating evidence is that each consumer connects through its assigned local private address without overlapping network route conflicts.

VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. However, the option would implement enable supported VNet flow logs with the intended storage and analysis configuration; the scenario instead requires use Defender for Cloud attack path analysis to identify exploitable exposure chains. The differentiating evidence is that the documented risky path is no longer present after remediating its actual exposure edge.

Connection troubleshoot evaluates the actual source-to-destination path rather than guessing from VM health status. However, the option would implement use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes; the scenario instead requires use Defender for Cloud attack path analysis to identify exploitable exposure chains. The differentiating evidence is that the documented risky path is no longer present after remediating its actual exposure edge.

Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. However, the option would implement use Defender for Cloud Cloud Security Explorer to query related security posture resources; the scenario instead requires use Defender for Cloud attack path analysis to identify exploitable exposure chains. The differentiating evidence is that the documented risky path is no longer present after remediating its actual exposure edge.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that repeated public asset requests show cache hits while authenticated account responses are not cached.

That observation would primarily validate another control: create specific Front Door routes matching the intended domain and path patterns to origin groups. A route connects domain/path matching with the origin group and forwarding behavior. The situation calls for evidence that repeated public asset requests show cache hits while authenticated account responses are not cached.

That observation would primarily validate another control: use the supported Front Door purge cache operation for affected URL patterns. Front Door cache purging invalidates stale edge copies in supported scopes. The situation calls for evidence that repeated public asset requests show cache hits while authenticated account responses are not cached.

An HTTP-to-HTTPS redirect moves the client to a TLS endpoint rather than serving sensitive content over HTTP. However, the option would implement configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway; the scenario instead requires enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. The differentiating evidence is that gateway capacity increases within configured limits and response/error metrics remain within target thresholds.

Layer-7 backend routing and TLS validation depend on the host and protocol settings. However, the option would implement align Application Gateway backend host-name and health-probe configuration with the origin virtual host; the scenario instead requires enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. The differentiating evidence is that gateway capacity increases within configured limits and response/error metrics remain within target thresholds.

URL path maps select backend targets on HTTP path matches, with default behavior for other paths. However, the option would implement configure path-based routing rules and suitable default backend pool in Application Gateway; the scenario instead requires enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. The differentiating evidence is that gateway capacity increases within configured limits and response/error metrics remain within target thresholds.

Connection approval separates consumer endpoint provisioning from provider authorization. However, the option would implement require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers; the scenario instead requires use individual approved private endpoint connections and enforce data-plane identity authorization. The differentiating evidence is that a permitted identity in an approved network succeeds and a denied identity or network cannot perform the protected operation.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires use individual approved private endpoint connections and enforce data-plane identity authorization. The differentiating evidence is that a permitted identity in an approved network succeeds and a denied identity or network cannot perform the protected operation.

The caller's own network integration and resolver path control whether it can use a private endpoint. However, the option would implement verify the service's VNet integration outbound route and private DNS configuration in the integration environment; the scenario instead requires use individual approved private endpoint connections and enforce data-plane identity authorization. The differentiating evidence is that a permitted identity in an approved network succeeds and a denied identity or network cannot perform the protected operation.

ExpressRoute Direct offers dedicated port pairs for creating supported ExpressRoute circuits at high scale. However, the option would implement evaluate ExpressRoute Direct and its dedicated port and peering-location requirements; the scenario instead requires use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. The differentiating evidence is that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. However, the option would implement select an ExpressRoute SKU and connectivity design that supports the needed geographic reach; the scenario instead requires use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. The differentiating evidence is that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

Cloud exchange, point-to-point and other provider models have different operational and physical requirements. However, the option would implement choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning; the scenario instead requires use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. The differentiating evidence is that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

Azure Load Balancer distributes layer-4 traffic to backend endpoints while an internal frontend stays private. However, the option would implement create an internal Azure Load Balancer with a private frontend and eligible backend pool; the scenario instead requires configure appropriate Load Balancer probe and rollout health gating for backend readiness. The differentiating evidence is that during a controlled single-instance failure the unhealthy node is excluded and healthy nodes continue serving.

Inbound NAT rules target specific backend machines instead of spreading a flow across a load-balanced pool. However, the option would implement create inbound NAT rules that map unique frontend ports to designated backend endpoints; the scenario instead requires configure appropriate Load Balancer probe and rollout health gating for backend readiness. The differentiating evidence is that during a controlled single-instance failure the unhealthy node is excluded and healthy nodes continue serving.

Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. However, the option would implement configure Azure Traffic Manager with the correct routing method and endpoint health checks; the scenario instead requires configure appropriate Load Balancer probe and rollout health gating for backend readiness. The differentiating evidence is that during a controlled single-instance failure the unhealthy node is excluded and healthy nodes continue serving.

That observation would primarily validate another control: reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants. Azure Firewall provisioning requires its reserved subnet and adequate address capacity. The situation calls for evidence that the expected collection handles a controlled test packet and its matching rule is logged.

That observation would primarily validate another control: send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. The situation calls for evidence that the expected collection handles a controlled test packet and its matching rule is logged.

That observation would primarily validate another control: enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering. FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. The situation calls for evidence that the expected collection handles a controlled test packet and its matching rule is logged.

That observation would primarily validate another control: configure HTTPS backend settings with suitable server certificate trust and host-name handling. Frontend TLS termination does not automatically encrypt the independent gateway-to-backend connection. The situation calls for evidence that the custom probe reports healthy and routed requests are delivered to the backend.

That observation would primarily validate another control: enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. The situation calls for evidence that the custom probe reports healthy and routed requests are delivered to the backend.

That observation would primarily validate another control: configure supported internal and public frontend IP configurations and bind listeners to the intended frontend. Frontend IP and listener bindings determine which network scope can reach each Application Gateway site. The situation calls for evidence that the custom probe reports healthy and routed requests are delivered to the backend.

That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

That observation would primarily validate another control: associate the intended route table with every subnet that must use that UDR policy. UDRs affect only subnets to which their route table is associated. The situation calls for evidence that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

That observation would primarily validate another control: enable appropriate forwarded traffic settings on the relevant peering connections and retain correct return routes. Traffic forwarded by an NVA requires compatible peering settings as well as layer-3 routing. The situation calls for evidence that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.