That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

That observation would primarily validate another control: associate the intended route table with every subnet that must use that UDR policy. UDRs affect only subnets to which their route table is associated. The situation calls for evidence that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

That observation would primarily validate another control: enable appropriate forwarded traffic settings on the relevant peering connections and retain correct return routes. Traffic forwarded by an NVA requires compatible peering settings as well as layer-3 routing. The situation calls for evidence that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

That observation would primarily validate another control: use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing. Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. The situation calls for evidence that during a controlled single-instance failure the unhealthy node is excluded and healthy nodes continue serving.

That observation would primarily validate another control: use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers. Cross-region Load Balancer extends supported layer-4 distribution across healthy regional frontends. The situation calls for evidence that during a controlled single-instance failure the unhealthy node is excluded and healthy nodes continue serving.

That observation would primarily validate another control: adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. The situation calls for evidence that during a controlled single-instance failure the unhealthy node is excluded and healthy nodes continue serving.

Load balancing applies only to members registered in its backend pool and passing health checks. However, the option would implement register eligible NIC IP configurations or supported resources in the load balancer backend pool; the scenario instead requires deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes. The differentiating evidence is that external clients connect through the public frontend and failed backends stop receiving traffic.

High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. However, the option would implement configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules; the scenario instead requires deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes. The differentiating evidence is that external clients connect through the public frontend and failed backends stop receiving traffic.

Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. However, the option would implement use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing; the scenario instead requires deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes. The differentiating evidence is that external clients connect through the public frontend and failed backends stop receiving traffic.

The caller's own network integration and resolver path control whether it can use a private endpoint. However, the option would implement verify the service's VNet integration outbound route and private DNS configuration in the integration environment; the scenario instead requires remove or reject only the obsolete private endpoint connection and clean up its DNS records. The differentiating evidence is that the retired consumer route no longer works and active approved consumers remain connected.

Some Private Link connections require resource-owner approval before private traffic is accepted. However, the option would implement approve the intended private endpoint connection on the target resource before testing access; the scenario instead requires remove or reject only the obsolete private endpoint connection and clean up its DNS records. The differentiating evidence is that the retired consumer route no longer works and active approved consumers remain connected.

Private DNS zone visibility follows VNet links and resolution architecture, not merely peering topology. However, the option would implement plan consistent private DNS zone links or resolver forwarding across the client VNets; the scenario instead requires remove or reject only the obsolete private endpoint connection and clean up its DNS records. The differentiating evidence is that the retired consumer route no longer works and active approved consumers remain connected.

VNet peering is not intrinsically transitive; a route or gateway strategy is required for spoke-to-spoke transit. However, the option would implement design an explicit routed transit path using an NVA or supported hub routing architecture; the scenario instead requires define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements. The differentiating evidence is that a test from a permitted hub path succeeds while a prohibited direct spoke-to-spoke path is absent.

Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. However, the option would implement inspect the effective-route longest-prefix match and add the proper more-specific route where supported; the scenario instead requires define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements. The differentiating evidence is that a test from a permitted hub path succeeds while a prohibited direct spoke-to-spoke path is absent.

A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. However, the option would implement review effective routes and keep the explicit appliance route when inspected forced tunneling is required; the scenario instead requires define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements. The differentiating evidence is that a test from a permitted hub path succeeds while a prohibited direct spoke-to-spoke path is absent.

That observation would primarily validate another control: use Traffic Manager Performance routing with enabled healthy endpoints. Performance routing maps DNS clients to suitable regional endpoints using the Traffic Manager performance model. The situation calls for evidence that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

That observation would primarily validate another control: configure Azure Traffic Manager with the correct routing method and endpoint health checks. Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. The situation calls for evidence that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

That observation would primarily validate another control: deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes. Public Load Balancer distributes layer-4 flows across healthy backends without inspecting URL paths. The situation calls for evidence that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

That observation would primarily validate another control: use WAF diagnostic logs to identify matched policy, rule and client/request details. Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. The situation calls for evidence that a safe test request triggers the documented edge action and no origin request is observed for a blocked sample.

That observation would primarily validate another control: start the WAF in detection mode, review matched rules and then enable prevention after tuning. Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. The situation calls for evidence that a safe test request triggers the documented edge action and no origin request is observed for a blocked sample.

That observation would primarily validate another control: attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode. WAF policies inspect HTTP application requests for known attack patterns rather than replacing NSG port controls. The situation calls for evidence that a safe test request triggers the documented edge action and no origin request is observed for a blocked sample.

Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. However, the option would implement choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing; the scenario instead requires enable an appropriate virtual network service endpoint and allow the subnet in the service firewall. The differentiating evidence is that the allowed subnet accesses the service while a disallowed VNet source is rejected by resource network rules.

Service endpoint routing does not bypass independent NSG or resource firewall enforcement. However, the option would implement allow the intended service-tag destination and necessary outbound flow in subnet security controls; the scenario instead requires enable an appropriate virtual network service endpoint and allow the subnet in the service firewall. The differentiating evidence is that the allowed subnet accesses the service while a disallowed VNet source is rejected by resource network rules.

Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. However, the option would implement use a private endpoint instead of a service endpoint for private-IP service access; the scenario instead requires enable an appropriate virtual network service endpoint and allow the subnet in the service firewall. The differentiating evidence is that the allowed subnet accesses the service while a disallowed VNet source is rejected by resource network rules.

Effective NSG evaluation identifies the allow or deny rule governing a specific flow. However, the option would implement use Network Watcher IP flow verify or effective security rules for the exact source/destination tuple; the scenario instead requires use Defender for Cloud Cloud Security Explorer to query related security posture resources. The differentiating evidence is that the query returns the expected exposed resources and excludes remediated or out-of-scope assets.

Connection troubleshoot evaluates the actual source-to-destination path rather than guessing from VM health status. However, the option would implement use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes; the scenario instead requires use Defender for Cloud Cloud Security Explorer to query related security posture resources. The differentiating evidence is that the query returns the expected exposed resources and excludes remediated or out-of-scope assets.

DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. However, the option would implement enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs; the scenario instead requires use Defender for Cloud Cloud Security Explorer to query related security posture resources. The differentiating evidence is that the query returns the expected exposed resources and excludes remediated or out-of-scope assets.

That observation would primarily validate another control: configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules. Outbound client-initiated traffic and unsolicited inbound sessions are separate NSG directions. The situation calls for evidence that a controlled source-address test is denied while permitted client ranges remain reachable.

That observation would primarily validate another control: store NSG configurations in versioned IaC and validate effective rules before and after deployment. Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. The situation calls for evidence that a controlled source-address test is denied while permitted client ranges remain reachable.

That observation would primarily validate another control: use the appropriate Azure service tag for supported NSG destination restrictions. Azure service tags abstract changing Azure service address ranges in network security rules. The situation calls for evidence that a controlled source-address test is denied while permitted client ranges remain reachable.

That observation would primarily validate another control: associate the NSG with the actual target subnet or network interface and validate effective policy. An unattached NSG does not evaluate workload traffic merely because its resource exists. The situation calls for evidence that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

That observation would primarily validate another control: match NSG rules to the effective private source and destination packet addresses at the NIC boundary. NSG policy evaluation sees packet addresses at its network scope rather than assuming Internet NAT addresses. The situation calls for evidence that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

That observation would primarily validate another control: create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points. Priority and network scope determine whether an explicit source-block rule matches before broad allows. The situation calls for evidence that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.