That observation would primarily validate another control: define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers. Two WAF enforcement points can both inspect requests; policy coordination reduces conflicting false positives. The situation calls for evidence that the legitimate header passes and a representative attack in unrelated fields remains detected.

That observation would primarily validate another control: apply a narrowly scoped WAF exclusion or supported per-rule override instead of disabling all protection. Targeted tuning preserves the broader managed rule set while addressing a justified false positive. The situation calls for evidence that the legitimate header passes and a representative attack in unrelated fields remains detected.

That observation would primarily validate another control: start the WAF in detection mode, review matched rules and then enable prevention after tuning. Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. The situation calls for evidence that the legitimate header passes and a representative attack in unrelated fields remains detected.

That observation would primarily validate another control: configure Azure Traffic Manager with the correct routing method and endpoint health checks. Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. The situation calls for evidence that traffic to each required transport port reaches healthy backend members according to expected flow distribution.

That observation would primarily validate another control: use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers. Cross-region Load Balancer extends supported layer-4 distribution across healthy regional frontends. The situation calls for evidence that traffic to each required transport port reaches healthy backend members according to expected flow distribution.

That observation would primarily validate another control: create inbound NAT rules that map unique frontend ports to designated backend endpoints. Inbound NAT rules target specific backend machines instead of spreading a flow across a load-balanced pool. The situation calls for evidence that traffic to each required transport port reaches healthy backend members according to expected flow distribution.

That observation would primarily validate another control: select Azure Firewall Premium and configure supported TLS inspection and IDPS settings. Advanced IDPS and TLS inspection are Premium capabilities and require certificate and policy planning. The situation calls for evidence that representative outbound tests from every protected subnet appear in the firewall log.

That observation would primarily validate another control: review Firewall Policy rule-collection-group and collection processing order and correct priorities. Azure Firewall policy evaluation order and processing rules determine which matching decision applies. The situation calls for evidence that representative outbound tests from every protected subnet appear in the firewall log.

That observation would primarily validate another control: send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. The situation calls for evidence that representative outbound tests from every protected subnet appear in the firewall log.

That observation would primarily validate another control: use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. Hierarchical policies provide centralized baselines while allowing controlled local additions. The situation calls for evidence that selected firewall tier supports required rules and monitored traffic stays within capacity.

That observation would primarily validate another control: reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants. Azure Firewall provisioning requires its reserved subnet and adequate address capacity. The situation calls for evidence that selected firewall tier supports required rules and monitored traffic stays within capacity.

That observation would primarily validate another control: use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. The situation calls for evidence that selected firewall tier supports required rules and monitored traffic stays within capacity.

That observation would primarily validate another control: associate the NSG with the actual target subnet or network interface and validate effective policy. An unattached NSG does not evaluate workload traffic merely because its resource exists. The situation calls for evidence that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

That observation would primarily validate another control: create an application security group and reference it in supported NSG rules for member network interfaces. ASGs identify groups of NICs for rule targets without hard-coding changing workload IPs. The situation calls for evidence that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

That observation would primarily validate another control: use the appropriate Azure service tag for supported NSG destination restrictions. Azure service tags abstract changing Azure service address ranges in network security rules. The situation calls for evidence that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

That observation would primarily validate another control: update the local network gateway resource with the remote VPN device public IP and correct prefixes. Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. The situation calls for evidence that iKE negotiation succeeds and protected test packets traverse the established IPsec security association.

That observation would primarily validate another control: design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. Internet-bound branch traffic requires explicit default-route propagation and a compatible secured hub path. The situation calls for evidence that iKE negotiation succeeds and protected test packets traverse the established IPsec security association.

That observation would primarily validate another control: enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. BGP distributes network prefixes across compatible VPN peers, avoiding repeated manual network updates. The situation calls for evidence that iKE negotiation succeeds and protected test packets traverse the established IPsec security association.

That observation would primarily validate another control: inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls. P2S gateway SKU limits and client tunnel health are distinct from account credential validity. The situation calls for evidence that the VPN client resolves the intended internal name privately and connects using that address.

That observation would primarily validate another control: regenerate and distribute the appropriate Azure VPN client configuration profile after gateway changes. Client settings must match the endpoint, routes and auth mode configured on the gateway. The situation calls for evidence that the VPN client resolves the intended internal name privately and connects using that address.

That observation would primarily validate another control: assign a distinct nonoverlapping P2S client address pool and republish the client configuration. Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. The situation calls for evidence that the VPN client resolves the intended internal name privately and connects using that address.

That observation would primarily validate another control: set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection. Time-series health signals and actionable alert thresholds provide earlier detection than manual portal checks. The situation calls for evidence that the documented risky path is no longer present after remediating its actual exposure edge.

That observation would primarily validate another control: compare Network Watcher effective routes and effective security rules for the affected NIC. Routing and filtering are independent controls; both must support a successful end-to-end connection. The situation calls for evidence that the documented risky path is no longer present after remediating its actual exposure edge.

That observation would primarily validate another control: use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends. Aggregated network views connect resource health and relevant network signals for operations analysis. The situation calls for evidence that the documented risky path is no longer present after remediating its actual exposure edge.

That observation would primarily validate another control: use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model. Virtual WAN supports specific managed NVA integrations and partner deployment requirements. The situation calls for evidence that the partner connection lacks protected prefixes while authorized business network routes remain reachable.

That observation would primarily validate another control: configure route propagation from the branch connection into the spoke's associated route table. Virtual hub route-table propagation determines which connection prefixes are visible to each subscriber. The situation calls for evidence that the partner connection lacks protected prefixes while authorized business network routes remain reachable.

That observation would primarily validate another control: deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. The situation calls for evidence that the partner connection lacks protected prefixes while authorized business network routes remain reachable.

That observation would primarily validate another control: create specific Front Door routes matching the intended domain and path patterns to origin groups. A route connects domain/path matching with the origin group and forwarding behavior. The situation calls for evidence that a distant client uses the edge address and backend logs show correct host-based routing through the regional gateway.

That observation would primarily validate another control: configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content. Front Door edge caching improves static content delivery only when caching policies respect dynamic or private data. The situation calls for evidence that a distant client uses the edge address and backend logs show correct host-based routing through the regional gateway.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that a distant client uses the edge address and backend logs show correct host-based routing through the regional gateway.

That observation would primarily validate another control: approve the intended private endpoint connection on the target resource before testing access. Some Private Link connections require resource-owner approval before private traffic is accepted. The situation calls for evidence that each consumer connects through its assigned local private address without overlapping network route conflicts.

That observation would primarily validate another control: publish only the eligible Private Link service target with appropriate access policy rather than VNet peering. Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. The situation calls for evidence that each consumer connects through its assigned local private address without overlapping network route conflicts.

That observation would primarily validate another control: require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. Connection approval separates consumer endpoint provisioning from provider authorization. The situation calls for evidence that each consumer connects through its assigned local private address without overlapping network route conflicts.