Stateful firewalls need consistent bidirectional session visibility or supported asymmetric-flow handling. However, the option would implement validate symmetric request and return routes through the stateful inspection appliance; the scenario instead requires apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. The differentiating evidence is that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

Route Server exchanges BGP information with compatible appliances and Azure networking instead of relying on static edits. However, the option would implement use Azure Route Server with a supported BGP peer to exchange routes dynamically; the scenario instead requires apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. The differentiating evidence is that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. However, the option would implement respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists; the scenario instead requires apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. The differentiating evidence is that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. However, the option would implement deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device; the scenario instead requires update local network gateway address spaces or validated BGP advertisements for the missing prefix. The differentiating evidence is that the new prefix is visible in learned or configured routes and a specific application connection succeeds.

IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. However, the option would implement align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN; the scenario instead requires update local network gateway address spaces or validated BGP advertisements for the missing prefix. The differentiating evidence is that the new prefix is visible in learned or configured routes and a specific application connection succeeds.

Tunnel control-plane status and Azure data-plane next-hop selection are separate conditions. However, the option would implement check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes; the scenario instead requires update local network gateway address spaces or validated BGP advertisements for the missing prefix. The differentiating evidence is that the new prefix is visible in learned or configured routes and a specific application connection succeeds.

That observation would primarily validate another control: use private backend addressing and implement egress separately through a controlled outbound path. Outbound connectivity does not require each backend NIC to carry a public address or accept inbound traffic. The situation calls for evidence that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

That observation would primarily validate another control: create purpose-specific subnets in the VNet and apply matching network security and routing controls. VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. The situation calls for evidence that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

That observation would primarily validate another control: allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity. Peering and hybrid routing require unambiguous destinations; overlapping prefixes prevent intended reachability. The situation calls for evidence that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

The inbound endpoint accepts hybrid DNS queries and can resolve private zones linked to its VNet. However, the option would implement deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP; the scenario instead requires create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs. The differentiating evidence is that an approved VM resolves the service FQDN to the private endpoint address and connects privately.

Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. However, the option would implement create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers; the scenario instead requires create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs. The differentiating evidence is that an approved VM resolves the service FQDN to the private endpoint address and connects privately.

Public Azure DNS zones and private DNS zones have different visibility and delegation semantics. However, the option would implement plan internal private DNS zones and public DNS hosting as distinct authoritative resolution scopes; the scenario instead requires create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs. The differentiating evidence is that an approved VM resolves the service FQDN to the private endpoint address and connects privately.

That observation would primarily validate another control: match NSG rules to the effective private source and destination packet addresses at the NIC boundary. NSG policy evaluation sees packet addresses at its network scope rather than assuming Internet NAT addresses. The situation calls for evidence that the effective rule analysis identifies the controlling deny and the permitted test passes after approved changes.

That observation would primarily validate another control: store NSG configurations in versioned IaC and validate effective rules before and after deployment. Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. The situation calls for evidence that the effective rule analysis identifies the controlling deny and the permitted test passes after approved changes.

That observation would primarily validate another control: enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment. New NSG flow logs are no longer supported; VNet flow logs are the recommended replacement. The situation calls for evidence that the effective rule analysis identifies the controlling deny and the permitted test passes after approved changes.

That observation would primarily validate another control: match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters. Private peering is a BGP arrangement and cannot establish with inconsistent peer identifiers or IP addressing. The situation calls for evidence that the provisioned ports and circuits match ordered capacity and private peering routes become usable.

That observation would primarily validate another control: configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. The situation calls for evidence that the provisioned ports and circuits match ordered capacity and private peering routes become usable.

That observation would primarily validate another control: inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. Circuit health and private peering do not guarantee a workload selects that route over more specific UDR entries. The situation calls for evidence that the provisioned ports and circuits match ordered capacity and private peering routes become usable.

That observation would primarily validate another control: choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. The situation calls for evidence that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

That observation would primarily validate another control: allow the intended service-tag destination and necessary outbound flow in subnet security controls. Service endpoint routing does not bypass independent NSG or resource firewall enforcement. The situation calls for evidence that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

That observation would primarily validate another control: use a private endpoint instead of a service endpoint for private-IP service access. Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. The situation calls for evidence that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

That observation would primarily validate another control: design an explicit routed transit path using an NVA or supported hub routing architecture. VNet peering is not intrinsically transitive; a route or gateway strategy is required for spoke-to-spoke transit. The situation calls for evidence that the spoke effective routes include on-premises prefixes and branch application traffic passes the gateway.

That observation would primarily validate another control: inspect the effective-route longest-prefix match and add the proper more-specific route where supported. Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. The situation calls for evidence that the spoke effective routes include on-premises prefixes and branch application traffic passes the gateway.

That observation would primarily validate another control: apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. Forced tunneling through an appliance requires an explicit default route from the workload subnet. The situation calls for evidence that the spoke effective routes include on-premises prefixes and branch application traffic passes the gateway.

NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. However, the option would implement attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet; the scenario instead requires associate the intended route table with every subnet that must use that UDR policy. The differentiating evidence is that test NICs in all selected subnets show the UDR while a deliberately excluded subnet retains its system routes.

A working BGP control plane does not guarantee the desired next hop when route tables override propagated paths. However, the option would implement compare effective routes and correct the conflicting UDR or route-propagation setting; the scenario instead requires associate the intended route table with every subnet that must use that UDR policy. The differentiating evidence is that test NICs in all selected subnets show the UDR while a deliberately excluded subnet retains its system routes.

Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. However, the option would implement define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements; the scenario instead requires associate the intended route table with every subnet that must use that UDR policy. The differentiating evidence is that test NICs in all selected subnets show the UDR while a deliberately excluded subnet retains its system routes.

Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. However, the option would implement configure hub gateway transit and enable use of remote gateways on the eligible spoke peering; the scenario instead requires attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet. The differentiating evidence is that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. However, the option would implement respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists; the scenario instead requires attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet. The differentiating evidence is that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

A working BGP control plane does not guarantee the desired next hop when route tables override propagated paths. However, the option would implement compare effective routes and correct the conflicting UDR or route-propagation setting; the scenario instead requires attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet. The differentiating evidence is that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

That observation would primarily validate another control: inventory DDoS protection plan associations and protected public IP resources in governance checks. A DDoS plan or protection policy only helps resources properly associated within its supported scope. The situation calls for evidence that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

That observation would primarily validate another control: route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. Collecting network flows is useful only if relevant logs reach an authorized searchable destination. The situation calls for evidence that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

That observation would primarily validate another control: collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes. An allow rule alone cannot establish name resolution, correct next hop and application endpoint identity. The situation calls for evidence that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.