That observation would primarily validate another control: associate the NSG with the actual target subnet or network interface and validate effective policy. An unattached NSG does not evaluate workload traffic merely because its resource exists. The situation calls for evidence that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

That observation would primarily validate another control: match NSG rules to the effective private source and destination packet addresses at the NIC boundary. NSG policy evaluation sees packet addresses at its network scope rather than assuming Internet NAT addresses. The situation calls for evidence that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

That observation would primarily validate another control: create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points. Priority and network scope determine whether an explicit source-block rule matches before broad allows. The situation calls for evidence that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

Some platform integrations require subnet delegation and cannot coexist with arbitrary resources in that subnet. However, the option would implement create an eligible dedicated subnet and apply the delegation required by the integrating Azure service; the scenario instead requires use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources. The differentiating evidence is that the worker serves internal requests without a public NIC IP and only approved ingress endpoints are Internet reachable.

Outbound connectivity does not require each backend NIC to carry a public address or accept inbound traffic. However, the option would implement use private backend addressing and implement egress separately through a controlled outbound path; the scenario instead requires use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources. The differentiating evidence is that the worker serves internal requests without a public NIC IP and only approved ingress endpoints are Internet reachable.

IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. However, the option would implement add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends; the scenario instead requires use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources. The differentiating evidence is that the worker serves internal requests without a public NIC IP and only approved ingress endpoints are Internet reachable.

Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. However, the option would implement start the WAF in detection mode, review matched rules and then enable prevention after tuning; the scenario instead requires configure supported WAF rate-limit or bot protection rules at the appropriate edge scope. The differentiating evidence is that a controlled burst triggers the intended policy while ordinary client traffic is permitted.

NSGs enforce network transport rules and do not parse application attack payloads. However, the option would implement deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters; the scenario instead requires configure supported WAF rate-limit or bot protection rules at the appropriate edge scope. The differentiating evidence is that a controlled burst triggers the intended policy while ordinary client traffic is permitted.

WAF policy association and custom rule match conditions determine where application-layer controls apply. However, the option would implement scope and associate appropriate WAF security policies to supported domains or path patterns; the scenario instead requires configure supported WAF rate-limit or bot protection rules at the appropriate edge scope. The differentiating evidence is that a controlled burst triggers the intended policy while ordinary client traffic is permitted.

Front Door is a globally distributed application delivery service that proxies and routes HTTP(S) traffic to healthy origins. However, the option would implement deploy Azure Front Door with appropriate origin groups and endpoint routes; the scenario instead requires configure Front Door origin-group health probes and suitable priority or weight settings. The differentiating evidence is that a controlled origin outage moves new requests to the healthy alternate without client DNS reconfiguration.

The client-to-edge and edge-to-origin TLS connections are distinct and must both be configured. However, the option would implement configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates; the scenario instead requires configure Front Door origin-group health probes and suitable priority or weight settings. The differentiating evidence is that a controlled origin outage moves new requests to the healthy alternate without client DNS reconfiguration.

Private Link origin connectivity requires accepted connection state and valid private endpoint/DNS behavior. However, the option would implement approve the required private endpoint connection and verify the origin's private link health; the scenario instead requires configure Front Door origin-group health probes and suitable priority or weight settings. The differentiating evidence is that a controlled origin outage moves new requests to the healthy alternate without client DNS reconfiguration.

That observation would primarily validate another control: provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway. Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. The situation calls for evidence that an authorized administrator opens an RDP or SSH session to a private VM without assigning it a public IP.

That observation would primarily validate another control: use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources. A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. The situation calls for evidence that an authorized administrator opens an RDP or SSH session to a private VM without assigning it a public IP.

That observation would primarily validate another control: create purpose-specific subnets in the VNet and apply matching network security and routing controls. VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. The situation calls for evidence that an authorized administrator opens an RDP or SSH session to a private VM without assigning it a public IP.

Aggregated network views connect resource health and relevant network signals for operations analysis. However, the option would implement use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends; the scenario instead requires use Network Watcher IP flow verify or effective security rules for the exact source/destination tuple. The differentiating evidence is that the tool reports the matching rule and an authorized test follows the expected action after remediation.

Routing and filtering are independent controls; both must support a successful end-to-end connection. However, the option would implement compare Network Watcher effective routes and effective security rules for the affected NIC; the scenario instead requires use Network Watcher IP flow verify or effective security rules for the exact source/destination tuple. The differentiating evidence is that the tool reports the matching rule and an authorized test follows the expected action after remediation.

DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. However, the option would implement enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs; the scenario instead requires use Network Watcher IP flow verify or effective security rules for the exact source/destination tuple. The differentiating evidence is that the tool reports the matching rule and an authorized test follows the expected action after remediation.

Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. However, the option would implement start the WAF in detection mode, review matched rules and then enable prevention after tuning; the scenario instead requires deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters. The differentiating evidence is that a safe attack-like HTTP request matches WAF rules while a normal TLS request reaches the application.

Managed rule set versions can change match behavior and should be tested against legitimate traffic. However, the option would implement review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence; the scenario instead requires deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters. The differentiating evidence is that a safe attack-like HTTP request matches WAF rules while a normal TLS request reaches the application.

WAF policy association and custom rule match conditions determine where application-layer controls apply. However, the option would implement scope and associate appropriate WAF security policies to supported domains or path patterns; the scenario instead requires deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters. The differentiating evidence is that a safe attack-like HTTP request matches WAF rules while a normal TLS request reaches the application.

That observation would primarily validate another control: compare Network Watcher effective routes and effective security rules for the affected NIC. Routing and filtering are independent controls; both must support a successful end-to-end connection. The situation calls for evidence that protection status is correct and authorized monitoring reports mitigation metrics during a test or observed attack.

That observation would primarily validate another control: use Defender for Cloud Cloud Security Explorer to query related security posture resources. Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. The situation calls for evidence that protection status is correct and authorized monitoring reports mitigation metrics during a test or observed attack.

That observation would primarily validate another control: route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. Collecting network flows is useful only if relevant logs reach an authorized searchable destination. The situation calls for evidence that protection status is correct and authorized monitoring reports mitigation metrics during a test or observed attack.

That observation would primarily validate another control: apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. NSGs filter packet tuples at subnet or NIC scope and can restrict access by source, destination, port and protocol. The situation calls for evidence that new member NICs receive expected traffic treatment and a nonmember remains excluded.

That observation would primarily validate another control: check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies. Both subnet and NIC security groups participate in evaluating traffic, so one permissive rule is insufficient. The situation calls for evidence that new member NICs receive expected traffic treatment and a nonmember remains excluded.

That observation would primarily validate another control: store NSG configurations in versioned IaC and validate effective rules before and after deployment. Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. The situation calls for evidence that new member NICs receive expected traffic treatment and a nonmember remains excluded.

That observation would primarily validate another control: assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply. Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. The situation calls for evidence that gateway metrics under a representative load remain within capacity and redundant branch paths stay connected.

That observation would primarily validate another control: update local network gateway address spaces or validated BGP advertisements for the missing prefix. A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. The situation calls for evidence that gateway metrics under a representative load remain within capacity and redundant branch paths stay connected.

That observation would primarily validate another control: resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU. Gateway SKUs have deployment and capacity requirements that must be met by the dedicated reserved subnet. The situation calls for evidence that gateway metrics under a representative load remain within capacity and redundant branch paths stay connected.

That observation would primarily validate another control: validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration. Always On VPN is a client-side management design with specific tunnel and infrastructure requirements. The situation calls for evidence that clients on approved platforms negotiate the selected tunnel and connect to the allowed subnet.

That observation would primarily validate another control: review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes. VPN authentication alone does not install all required routes to remote interconnected networks. The situation calls for evidence that clients on approved platforms negotiate the selected tunnel and connect to the allowed subnet.

That observation would primarily validate another control: constrain client routing and enforce destination access with NSGs and identity-aware controls. P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. The situation calls for evidence that clients on approved platforms negotiate the selected tunnel and connect to the allowed subnet.