Private endpoints do not necessarily disable a service's existing public network endpoint automatically. However, the option would implement restrict or disable the PaaS resource's public network access separately from creating its private endpoint; the scenario instead requires create the needed private endpoints and matching DNS zones for each required supported storage subresource. The differentiating evidence is that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. However, the option would implement publish only the eligible Private Link service target with appropriate access policy rather than VNet peering; the scenario instead requires create the needed private endpoints and matching DNS zones for each required supported storage subresource. The differentiating evidence is that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

Some Private Link connections require resource-owner approval before private traffic is accepted. However, the option would implement approve the intended private endpoint connection on the target resource before testing access; the scenario instead requires create the needed private endpoints and matching DNS zones for each required supported storage subresource. The differentiating evidence is that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

Two WAF enforcement points can both inspect requests; policy coordination reduces conflicting false positives. However, the option would implement define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers; the scenario instead requires use WAF diagnostic logs to identify matched policy, rule and client/request details. The differentiating evidence is that the analyst correlates the request ID with a specific rule and documents an approved remediation.

WAF custom rate limits and bot controls can mitigate application-layer request floods when correctly scoped. However, the option would implement configure supported WAF rate-limit or bot protection rules at the appropriate edge scope; the scenario instead requires use WAF diagnostic logs to identify matched policy, rule and client/request details. The differentiating evidence is that the analyst correlates the request ID with a specific rule and documents an approved remediation.

Geographic filtering requires explicit request-based policy and should not be confused with backend origin placement. However, the option would implement define WAF custom geographic match rules or supported edge access controls for the target domains; the scenario instead requires use WAF diagnostic logs to identify matched policy, rule and client/request details. The differentiating evidence is that the analyst correlates the request ID with a specific rule and documents an approved remediation.

Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. However, the option would implement assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment; the scenario instead requires configure P2S root certificate trust and issue valid client certificates from the approved CA. The differentiating evidence is that a valid test client establishes the VPN while a certificate from an untrusted issuer is denied.

Certificate trust must be able to exclude compromised or retired client certificates. However, the option would implement revoke or deny the specific P2S client certificate by supported gateway configuration and policy; the scenario instead requires configure P2S root certificate trust and issue valid client certificates from the approved CA. The differentiating evidence is that a valid test client establishes the VPN while a certificate from an untrusted issuer is denied.

P2S connection establishes reachability but private DNS lookup depends on client and gateway DNS settings. However, the option would implement provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration; the scenario instead requires configure P2S root certificate trust and issue valid client certificates from the approved CA. The differentiating evidence is that a valid test client establishes the VPN while a certificate from an untrusted issuer is denied.

That observation would primarily validate another control: attach a supported Application Gateway WAF policy in the intended enforcement mode. Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. The situation calls for evidence that requests with each hostname reach the intended backend while a mismatched host is rejected or handled per design.

That observation would primarily validate another control: move the gateway into a supported dedicated subnet with adequate addresses for expected scaling. Application Gateway has subnet placement and IP capacity requirements distinct from backend pools. The situation calls for evidence that requests with each hostname reach the intended backend while a mismatched host is rejected or handled per design.

That observation would primarily validate another control: replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. The situation calls for evidence that requests with each hostname reach the intended backend while a mismatched host is rejected or handled per design.

Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. However, the option would implement select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication; the scenario instead requires validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration. The differentiating evidence is that a managed device establishes the expected VPN under approved triggers without manual profile entry.

P2S gateway SKU limits and client tunnel health are distinct from account credential validity. However, the option would implement inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls; the scenario instead requires validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration. The differentiating evidence is that a managed device establishes the expected VPN under approved triggers without manual profile entry.

P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. However, the option would implement constrain client routing and enforce destination access with NSGs and identity-aware controls; the scenario instead requires validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration. The differentiating evidence is that a managed device establishes the expected VPN under approved triggers without manual profile entry.

Inbound Private Resolver resolves private zones available through its network's DNS resolution context. However, the option would implement link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path; the scenario instead requires enable autoregistration for the appropriate VNet link to an Azure Private DNS zone. The differentiating evidence is that a newly deployed test VM appears in the zone and resolves from a permitted linked VNet.

Forwarding to an inbound endpoint from a ruleset linked to that same resolver VNet can cause a DNS loop. However, the option would implement remove a self-referential forwarding ruleset link or rule to prevent a resolver forwarding loop; the scenario instead requires enable autoregistration for the appropriate VNet link to an Azure Private DNS zone. The differentiating evidence is that a newly deployed test VM appears in the zone and resolves from a permitted linked VNet.

The inbound endpoint accepts hybrid DNS queries and can resolve private zones linked to its VNet. However, the option would implement deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP; the scenario instead requires enable autoregistration for the appropriate VNet link to an Azure Private DNS zone. The differentiating evidence is that a newly deployed test VM appears in the zone and resolves from a permitted linked VNet.

Private Link connectivity commonly depends on the appropriate privatelink DNS zone and VNet link. However, the option would implement create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs; the scenario instead requires plan internal private DNS zones and public DNS hosting as distinct authoritative resolution scopes. The differentiating evidence is that internal clients receive approved private records while external public clients see only intended public records.

Outbound endpoints and forwarding rules let Azure-resident clients resolve selected external DNS namespaces. However, the option would implement configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix; the scenario instead requires plan internal private DNS zones and public DNS hosting as distinct authoritative resolution scopes. The differentiating evidence is that internal clients receive approved private records while external public clients see only intended public records.

Ruleset links determine which VNets apply the conditional forwarding rules; peering alone is insufficient. However, the option would implement link the intended spoke VNet to the appropriate DNS forwarding ruleset; the scenario instead requires plan internal private DNS zones and public DNS hosting as distinct authoritative resolution scopes. The differentiating evidence is that internal clients receive approved private records while external public clients see only intended public records.

That observation would primarily validate another control: use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. The situation calls for evidence that route tables show the intended prefixes and application testing reaches the branch destination.

That observation would primarily validate another control: use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model. Virtual WAN supports specific managed NVA integrations and partner deployment requirements. The situation calls for evidence that route tables show the intended prefixes and application testing reaches the branch destination.

That observation would primarily validate another control: deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections. Virtual WAN Standard supports centralized hub routing and expanded branch/VNet connectivity services. The situation calls for evidence that route tables show the intended prefixes and application testing reaches the branch destination.

That observation would primarily validate another control: add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. The situation calls for evidence that future-service subnet reservations fit without overlapping or requiring emergency VNet renumbering.

That observation would primarily validate another control: use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs. Bring-your-own-IP requires prefix validation and provisioning rather than treating any arbitrary public range as Azure owned. The situation calls for evidence that future-service subnet reservations fit without overlapping or requiring emergency VNet renumbering.

That observation would primarily validate another control: choose the service-supported delegated subnet and remove incompatible delegation or workload placements. Subnet delegation is scoped to supported service providers and imposes placement constraints. The situation calls for evidence that future-service subnet reservations fit without overlapping or requiring emergency VNet renumbering.

Different Virtual WAN gateway types have configurable scale units and supported limits. However, the option would implement choose the appropriate Virtual WAN hub gateway scale units and capacity parameters; the scenario instead requires deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. The differentiating evidence is that workload Internet egress follows the secured hub firewall and a representative policy event is logged.

Virtual WAN supports user VPN gateways for individually authenticated client connectivity. However, the option would implement deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration; the scenario instead requires deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. The differentiating evidence is that workload Internet egress follows the secured hub firewall and a representative policy event is logged.

Virtual hub routing depends on the association and propagation configuration of each connection. However, the option would implement correct Virtual WAN route table associations and propagation labels for the connected networks; the scenario instead requires deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. The differentiating evidence is that workload Internet egress follows the secured hub firewall and a representative policy event is logged.

That observation would primarily validate another control: correct Virtual WAN route table associations and propagation labels for the connected networks. Virtual hub routing depends on the association and propagation configuration of each connection. The situation calls for evidence that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

That observation would primarily validate another control: design Virtual WAN traffic security explicitly with compatible firewall and routing features. Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. The situation calls for evidence that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

That observation would primarily validate another control: select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features. Basic and Standard Virtual WAN SKUs expose different hub and connectivity capabilities. The situation calls for evidence that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.