An ASE v3 deployment fails management connectivity after an engineer strips the ASE subnet NSG and points 0.0.0.0/0 at an NVA without the documented ASE exceptions. What should the security engineer restore?
Select an answer to reveal the explanation.
Short Explanation
ASE isn’t a free-for-all subnet. Leave the required NSG rules and UDR exceptions in place so Azure can still manage the environment—then inspect tenant traffic without cutting the platform’s lifeline.
Full Explanation
ASE v3 is VNet-injected and depends on documented NSG rules and UDR patterns for platform management and outbound dependencies. Hardening that removes those requirements breaks management even if tenant inspection is the goal. Blanket deletion of ASE subnet NSGs is incorrect. Forcing all platform traffic through an NVA or firewall without documented exceptions also breaks ASE. Migrating off ASE to multi-tenant App Service plus Service Endpoints is a different architecture, not a fix for ASE subnet hardening mistakes.