Pass Your Microsoft SC-500 Exam Easy!

Creating another Private Link service does not expose the original source identity behind already NAT-translated private-link requests.

Revoking an unrelated consumer connection does not explain NAT addresses presented by legitimate approved private endpoint traffic.

Checking the public load-balancer frontend is appropriate for public exposure assessment, but the incident concerns observed private-link source translation.

Troubleshooting a pending publisher approval presupposes that a Private Link service and endpoint connection already exist.

Revoking a provider endpoint is inappropriate because the team has not established the correct provider publishing design yet.

Investigating public exposure matters after publishing but does not make a service-endpoint rule into a consumer Private Link service.

Reviewing public exposure is important security hygiene but does not diagnose why one approved consumer subnet reaches the private service and another does not.

Recreating a provider Private Link service is unjustified while an approved consumer subnet already reaches the existing service.

Revoking a customer endpoint connection would reduce access and is not a repair for a permitted but unreachable subnet.

Creating another provider service increases exposure and does not remove the revoked customer’s access to the existing one.

Inspecting approval state confirms the customer is connected but leaves the authorization in place until the provider acts.

Comparing service endpoints with Private Link does not terminate the specific customer’s already approved connection.

Troubleshooting consumer DNS and routes cannot prevent internet clients reaching the service through an independent public frontend.

Understanding provider SNAT is irrelevant to a separate unrestricted public inbound load-balancer path.

Clarifying the service endpoint versus Private Link distinction does not close the still publicly accessible load-balancer address.

Allowing all HTTPS names defeats the allowlist even if observability later reveals which unauthorized sites were contacted.

SNI/connection logging is evidence and detection; observing the destination alone does not enforce a deny.

A broad network rule for TCP 443 can allow traffic before more-specific application FQDN rules would constrain it; a later rule cannot reverse an already granted network decision.

Changing a priority number inside application collections cannot supersede a network-rule match because rule type precedence is evaluated first.

Restricting the FQDN allowlist is valuable, but cannot reverse a broader TCP network Allow already terminating packet evaluation before the application stage.

Adding an application deny alone does not block traffic already matched by the earlier TCP 443 network Allow.

Checking the NSG and route is an important backend reachability test after publication, not the Azure Firewall rule that exposes the chosen service frontend.

Outbound HTTPS application FQDN rules are not used to publish inbound TCP connections through Azure Firewall.

Firewall Premium IDPS analyzes threats, but it does not publish an inbound service by translating a destination to its backend.

Application rules never override earlier matching network rules, but this scenario concerns parent-versus-child ordering within the same rule type.

Changing only a child priority cannot make its rule outrank inherited parent collections; priority is not global across the hierarchy.

IDPS inspection mode is unrelated to why an inherited Firewall Policy parent Allow or Deny is evaluated before an apparently higher-priority child rule.

Changing FQDN wildcard patterns before verifying the client’s TLS hostname can conceal a client-protocol problem and expand the allow surface.

Network-rule precedence matters only if a network rule actually matched this traffic; it does not replace the requested diagnosis of missing/wrong TLS SNI.

Writing a new broad allow rule may mask the client hostname defect and weaken the policy before matching evidence is collected.

Parent policy precedence only matters if these rules are in different inherited policy levels; this example places both in the same type and policy level.

Refining an unrelated FQDN application rule does not change a network-rule Allow that matched before the later Deny.

Network-versus-application precedence is not the issue because the question specifies two network rule collections.