That observation would primarily validate another control: apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. Forced tunneling through an appliance requires an explicit default route from the workload subnet. The situation calls for evidence that cross-spoke traffic is forwarded through the appliance with matching request and return packets.

That observation would primarily validate another control: configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. The situation calls for evidence that cross-spoke traffic is forwarded through the appliance with matching request and return packets.

That observation would primarily validate another control: compare effective routes and correct the conflicting UDR or route-propagation setting. A working BGP control plane does not guarantee the desired next hop when route tables override propagated paths. The situation calls for evidence that cross-spoke traffic is forwarded through the appliance with matching request and return packets.

That observation would primarily validate another control: configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets. RADIUS authentication depends on an accessible server and consistent protocol/authentication configuration. The situation calls for evidence that a freshly configured client imports the new profile and reaches the expected VNet resources.

That observation would primarily validate another control: constrain client routing and enforce destination access with NSGs and identity-aware controls. P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. The situation calls for evidence that a freshly configured client imports the new profile and reaches the expected VNet resources.

That observation would primarily validate another control: provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration. P2S connection establishes reachability but private DNS lookup depends on client and gateway DNS settings. The situation calls for evidence that a freshly configured client imports the new profile and reaches the expected VNet resources.

That observation would primarily validate another control: assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. The situation calls for evidence that the contractor can access the approved project service but an unauthorized sensitive subnet is blocked.

That observation would primarily validate another control: provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration. P2S connection establishes reachability but private DNS lookup depends on client and gateway DNS settings. The situation calls for evidence that the contractor can access the approved project service but an unauthorized sensitive subnet is blocked.

That observation would primarily validate another control: select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication. Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. The situation calls for evidence that the contractor can access the approved project service but an unauthorized sensitive subnet is blocked.

That observation would primarily validate another control: create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. The situation calls for evidence that the branch resolves the correct private IP and a protocol-level connection succeeds over the authorized route.

That observation would primarily validate another control: remove a self-referential forwarding ruleset link or rule to prevent a resolver forwarding loop. Forwarding to an inbound endpoint from a ruleset linked to that same resolver VNet can cause a DNS loop. The situation calls for evidence that the branch resolves the correct private IP and a protocol-level connection succeeds over the authorized route.

That observation would primarily validate another control: apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. DNS-layer policy can block known malicious domains without treating an IP firewall allow rule as DNS security. The situation calls for evidence that the branch resolves the correct private IP and a protocol-level connection succeeds over the authorized route.

Both subnet and NIC security groups participate in evaluating traffic, so one permissive rule is insufficient. However, the option would implement check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies; the scenario instead requires apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. The differentiating evidence is that only the named approved source can open the management or database port while unapproved sources are denied.

NSG policy evaluation sees packet addresses at its network scope rather than assuming Internet NAT addresses. However, the option would implement match NSG rules to the effective private source and destination packet addresses at the NIC boundary; the scenario instead requires apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. The differentiating evidence is that only the named approved source can open the management or database port while unapproved sources are denied.

Priority and network scope determine whether an explicit source-block rule matches before broad allows. However, the option would implement create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points; the scenario instead requires apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. The differentiating evidence is that only the named approved source can open the management or database port while unapproved sources are denied.

URL path maps select backend targets on HTTP path matches, with default behavior for other paths. However, the option would implement configure path-based routing rules and suitable default backend pool in Application Gateway; the scenario instead requires add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. The differentiating evidence is that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

Frontend TLS termination does not automatically encrypt the independent gateway-to-backend connection. However, the option would implement configure HTTPS backend settings with suitable server certificate trust and host-name handling; the scenario instead requires add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. The differentiating evidence is that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. However, the option would implement enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings; the scenario instead requires add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. The differentiating evidence is that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. However, the option would implement use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation; the scenario instead requires select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features. The differentiating evidence is that the intended gateway and secured-hub features can be provisioned and expected connections establish.

Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. However, the option would implement deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies; the scenario instead requires select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features. The differentiating evidence is that the intended gateway and secured-hub features can be provisioned and expected connections establish.

Virtual WAN gateway components are service-specific; S2S VPN gateway does not terminate ExpressRoute. However, the option would implement provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits; the scenario instead requires select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features. The differentiating evidence is that the intended gateway and secured-hub features can be provisioned and expected connections establish.

Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. However, the option would implement choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing; the scenario instead requires apply supported service endpoint policies with the authorized storage resource definitions. The differentiating evidence is that allowed storage accesses succeed while attempts toward an unapproved account are blocked.

A service endpoint is a VNet subnet property and does not directly make arbitrary branch source IPs part of that subnet. However, the option would implement use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required; the scenario instead requires apply supported service endpoint policies with the authorized storage resource definitions. The differentiating evidence is that allowed storage accesses succeed while attempts toward an unapproved account are blocked.

Service endpoint enablement alone does not grant access at the PaaS service network policy layer. However, the option would implement add the selected VNet/subnet to the target service's virtual network access rules; the scenario instead requires apply supported service endpoint policies with the authorized storage resource definitions. The differentiating evidence is that allowed storage accesses succeed while attempts toward an unapproved account are blocked.

Correct name resolution does not create connectivity; routing, firewall and endpoint access still matter. However, the option would implement validate DNS resolution separately from IP routing and provide an approved private network path; the scenario instead requires deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP. The differentiating evidence is that on-premises nslookup against the conditional forwarder returns the expected Azure private address.

Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. However, the option would implement add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace; the scenario instead requires deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP. The differentiating evidence is that on-premises nslookup against the conditional forwarder returns the expected Azure private address.

Existing workloads may retain DNS settings obtained before a VNet-level resolver change. However, the option would implement refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings; the scenario instead requires deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP. The differentiating evidence is that on-premises nslookup against the conditional forwarder returns the expected Azure private address.

That observation would primarily validate another control: link the intended spoke VNet to the appropriate DNS forwarding ruleset. Ruleset links determine which VNets apply the conditional forwarding rules; peering alone is insufficient. The situation calls for evidence that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

That observation would primarily validate another control: reduce record TTL before a planned migration and validate propagation and client cache expiry. DNS caching can delay a record change independently of network route availability. The situation calls for evidence that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

That observation would primarily validate another control: validate DNS resolution separately from IP routing and provide an approved private network path. Correct name resolution does not create connectivity; routing, firewall and endpoint access still matter. The situation calls for evidence that affected VMs show the new resolver IP and successfully resolve representative internal and external records.