Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS. The differentiating evidence is that a datacenter client resolves the private IP and accesses the resource over the private link path.

A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. However, the option would implement provide separate approved private endpoints for each consumer to the shared eligible Private Link service; the scenario instead requires route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS. The differentiating evidence is that a datacenter client resolves the private IP and accesses the resource over the private link path.

Private Link endpoint creation does not guarantee client DNS queries return the private IP. However, the option would implement link the correct service-specific private DNS zone to the client VNet and verify A-record resolution; the scenario instead requires route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS. The differentiating evidence is that a datacenter client resolves the private IP and accesses the resource over the private link path.

A standalone policy object does not inspect traffic until attached to an applicable gateway scope. However, the option would implement associate the WAF policy to the intended Application Gateway scope, listener or route as supported; the scenario instead requires deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters. The differentiating evidence is that a safe attack-like HTTP request matches WAF rules while a normal TLS request reaches the application.

Front Door WAF applies application-layer filtering at the Microsoft edge for protected routes. However, the option would implement associate a Front Door WAF policy with the intended endpoint domains through a security policy; the scenario instead requires deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters. The differentiating evidence is that a safe attack-like HTTP request matches WAF rules while a normal TLS request reaches the application.

WAF custom rate limits and bot controls can mitigate application-layer request floods when correctly scoped. However, the option would implement configure supported WAF rate-limit or bot protection rules at the appropriate edge scope; the scenario instead requires deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters. The differentiating evidence is that a safe attack-like HTTP request matches WAF rules while a normal TLS request reaches the application.

Load balancing applies only to members registered in its backend pool and passing health checks. However, the option would implement register eligible NIC IP configurations or supported resources in the load balancer backend pool; the scenario instead requires create inbound NAT rules that map unique frontend ports to designated backend endpoints. The differentiating evidence is that connecting to the assigned frontend management port consistently reaches the intended backend instance.

High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. However, the option would implement configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules; the scenario instead requires create inbound NAT rules that map unique frontend ports to designated backend endpoints. The differentiating evidence is that connecting to the assigned frontend management port consistently reaches the intended backend instance.

Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. However, the option would implement use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing; the scenario instead requires create inbound NAT rules that map unique frontend ports to designated backend endpoints. The differentiating evidence is that connecting to the assigned frontend management port consistently reaches the intended backend instance.

Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. However, the option would implement assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply; the scenario instead requires enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. The differentiating evidence is that a newly advertised test branch prefix appears in Azure learned routes and is reachable.

Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. However, the option would implement choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed; the scenario instead requires enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. The differentiating evidence is that a newly advertised test branch prefix appears in Azure learned routes and is reachable.

Gateway transit makes the shared hub VPN connection available to eligible peered spokes. However, the option would implement enable hub gateway transit and compatible remote-gateway peering usage on the spoke; the scenario instead requires enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. The differentiating evidence is that a newly advertised test branch prefix appears in Azure learned routes and is reachable.

VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. However, the option would implement enable supported VNet flow logs with the intended storage and analysis configuration; the scenario instead requires use Network Watcher connectivity testing and route diagnostics from a representative Azure source. The differentiating evidence is that tests identify the blocked or misrouted hop and the restored application port connects across the hybrid path.

Routing and filtering are independent controls; both must support a successful end-to-end connection. However, the option would implement compare Network Watcher effective routes and effective security rules for the affected NIC; the scenario instead requires use Network Watcher connectivity testing and route diagnostics from a representative Azure source. The differentiating evidence is that tests identify the blocked or misrouted hop and the restored application port connects across the hybrid path.

An allow rule alone cannot establish name resolution, correct next hop and application endpoint identity. However, the option would implement collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes; the scenario instead requires use Network Watcher connectivity testing and route diagnostics from a representative Azure source. The differentiating evidence is that tests identify the blocked or misrouted hop and the restored application port connects across the hybrid path.

Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. However, the option would implement send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination; the scenario instead requires configure a DNAT rule with the intended public destination, private target and matching security controls. The differentiating evidence is that an external test reaches only the published internal service and unrelated ports remain inaccessible.

Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. However, the option would implement use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance; the scenario instead requires configure a DNAT rule with the intended public destination, private target and matching security controls. The differentiating evidence is that an external test reaches only the published internal service and unrelated ports remain inaccessible.

Azure Firewall policy evaluation order and processing rules determine which matching decision applies. However, the option would implement review Firewall Policy rule-collection-group and collection processing order and correct priorities; the scenario instead requires configure a DNAT rule with the intended public destination, private target and matching security controls. The differentiating evidence is that an external test reaches only the published internal service and unrelated ports remain inaccessible.

That observation would primarily validate another control: change the tuned WAF policy to prevention mode and confirm the intended managed rule action. Prevention mode can block matching HTTP requests, while detection mode is nonblocking. The situation calls for evidence that a safe test request triggers the documented edge action and no origin request is observed for a blocked sample.

That observation would primarily validate another control: associate the WAF policy to the intended Application Gateway scope, listener or route as supported. A standalone policy object does not inspect traffic until attached to an applicable gateway scope. The situation calls for evidence that a safe test request triggers the documented edge action and no origin request is observed for a blocked sample.

That observation would primarily validate another control: deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters. NSGs enforce network transport rules and do not parse application attack payloads. The situation calls for evidence that a safe test request triggers the documented edge action and no origin request is observed for a blocked sample.

Private endpoint NSG and UDR enforcement depends on subnet network policy configuration. However, the option would implement configure supported private endpoint network-policy settings and relevant NSG rules where enabled; the scenario instead requires correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. The differentiating evidence is that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

Outbound client-initiated traffic and unsolicited inbound sessions are separate NSG directions. However, the option would implement configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules; the scenario instead requires correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. The differentiating evidence is that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

IP-prefix and application security group membership determine which NSG rules match relocated workloads. However, the option would implement update NSG source or ASG membership for the new workload placement after validating its identity; the scenario instead requires correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. The differentiating evidence is that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

That observation would primarily validate another control: evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. ExpressRoute Direct offers dedicated port pairs for creating supported ExpressRoute circuits at high scale. The situation calls for evidence that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

That observation would primarily validate another control: choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning. Cloud exchange, point-to-point and other provider models have different operational and physical requirements. The situation calls for evidence that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

That observation would primarily validate another control: select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. The situation calls for evidence that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

That observation would primarily validate another control: use a private endpoint instead of a service endpoint for private-IP service access. Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. The situation calls for evidence that a client on the allowed subnet connects and a test client outside the service firewall rules is denied.

That observation would primarily validate another control: apply supported service endpoint policies with the authorized storage resource definitions. Service endpoint policies can narrow egress to supported Azure service resources rather than all accounts. The situation calls for evidence that a client on the allowed subnet connects and a test client outside the service firewall rules is denied.

That observation would primarily validate another control: review service endpoint behavior and update the target service's VNet network rules rather than relying only on public egress IPs. Service endpoint traffic is governed by virtual network identity and service firewall rules. The situation calls for evidence that a client on the allowed subnet connects and a test client outside the service firewall rules is denied.

Private endpoints do not necessarily disable a service's existing public network endpoint automatically. However, the option would implement restrict or disable the PaaS resource's public network access separately from creating its private endpoint; the scenario instead requires create the needed private endpoints and matching DNS zones for each required supported storage subresource. The differentiating evidence is that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. However, the option would implement publish only the eligible Private Link service target with appropriate access policy rather than VNet peering; the scenario instead requires create the needed private endpoints and matching DNS zones for each required supported storage subresource. The differentiating evidence is that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

Some Private Link connections require resource-owner approval before private traffic is accepted. However, the option would implement approve the intended private endpoint connection on the target resource before testing access; the scenario instead requires create the needed private endpoints and matching DNS zones for each required supported storage subresource. The differentiating evidence is that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.