That observation would primarily validate another control: correct Virtual WAN route table associations and propagation labels for the connected networks. Virtual hub routing depends on the association and propagation configuration of each connection. The situation calls for evidence that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

That observation would primarily validate another control: design Virtual WAN traffic security explicitly with compatible firewall and routing features. Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. The situation calls for evidence that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

That observation would primarily validate another control: select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features. Basic and Standard Virtual WAN SKUs expose different hub and connectivity capabilities. The situation calls for evidence that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

That observation would primarily validate another control: update the local network gateway resource with the remote VPN device public IP and correct prefixes. Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. The situation calls for evidence that the tunnel status is connected and representative branch subnets reach the approved Azure prefixes.

That observation would primarily validate another control: configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints. Active-active VPN gateway instances can provide redundant tunnel paths when peer devices support the design. The situation calls for evidence that the tunnel status is connected and representative branch subnets reach the approved Azure prefixes.

That observation would primarily validate another control: update local network gateway address spaces or validated BGP advertisements for the missing prefix. A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. The situation calls for evidence that the tunnel status is connected and representative branch subnets reach the approved Azure prefixes.

Both subnet and NIC security groups participate in evaluating traffic, so one permissive rule is insufficient. However, the option would implement check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies; the scenario instead requires match NSG rules to the effective private source and destination packet addresses at the NIC boundary. The differentiating evidence is that iP flow verify reports the intended private-address rule and the internal application test passes.

Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. However, the option would implement create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route; the scenario instead requires match NSG rules to the effective private source and destination packet addresses at the NIC boundary. The differentiating evidence is that iP flow verify reports the intended private-address rule and the internal application test passes.

NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. However, the option would implement correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering; the scenario instead requires match NSG rules to the effective private source and destination packet addresses at the NIC boundary. The differentiating evidence is that iP flow verify reports the intended private-address rule and the internal application test passes.

Network allow lists and data-plane authorization are independent controls. However, the option would implement combine service endpoint network rules with proper service authentication and RBAC or access policies; the scenario instead requires use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required. The differentiating evidence is that the branch resolves and connects through a private endpoint or its own explicitly allowed service network path.

Service endpoints are configured at subnet level, not automatically across an entire VNet. However, the option would implement enable the supported service endpoint on each specific subnet that requires the Azure service network identity; the scenario instead requires use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required. The differentiating evidence is that the branch resolves and connects through a private endpoint or its own explicitly allowed service network path.

Service endpoint policies can narrow egress to supported Azure service resources rather than all accounts. However, the option would implement apply supported service endpoint policies with the authorized storage resource definitions; the scenario instead requires use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required. The differentiating evidence is that the branch resolves and connects through a private endpoint or its own explicitly allowed service network path.

Layer-7 backend routing and TLS validation depend on the host and protocol settings. However, the option would implement align Application Gateway backend host-name and health-probe configuration with the origin virtual host; the scenario instead requires configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway. The differentiating evidence is that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. However, the option would implement configure appropriate multi-site listeners and host-based routing rules on Application Gateway; the scenario instead requires configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway. The differentiating evidence is that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

Application Gateway provides regional layer-7 routing and TLS termination for HTTP services. However, the option would implement deploy Azure Application Gateway with HTTPS listener and path-based routing rules; the scenario instead requires configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway. The differentiating evidence is that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

That observation would primarily validate another control: select a supported VPN gateway SKU meeting tunnel counts, throughput, BGP and resiliency requirements. Gateway SKU capacity and feature support determine whether a hybrid design can meet operational needs. The situation calls for evidence that the packet path is identified and a corrected route sends traffic over the intended active tunnel.

That observation would primarily validate another control: align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN. IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. The situation calls for evidence that the packet path is identified and a corrected route sends traffic over the intended active tunnel.

That observation would primarily validate another control: choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed. Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. The situation calls for evidence that the packet path is identified and a corrected route sends traffic over the intended active tunnel.

That observation would primarily validate another control: complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. The situation calls for evidence that a controlled request receives the required destination or reaches the rewritten origin path.

That observation would primarily validate another control: create specific Front Door routes matching the intended domain and path patterns to origin groups. A route connects domain/path matching with the origin group and forwarding behavior. The situation calls for evidence that a controlled request receives the required destination or reaches the rewritten origin path.

That observation would primarily validate another control: configure an appropriate lightweight unauthenticated Front Door origin health probe path. Edge origin health assessment should use a consistently reachable probe without costly application side effects. The situation calls for evidence that a controlled request receives the required destination or reaches the rewritten origin path.

That observation would primarily validate another control: configure supported internal and public frontend IP configurations and bind listeners to the intended frontend. Frontend IP and listener bindings determine which network scope can reach each Application Gateway site. The situation calls for evidence that the probe stops reporting hostname errors and a client request reaches the correct virtual host.

That observation would primarily validate another control: replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. The situation calls for evidence that the probe stops reporting hostname errors and a client request reaches the correct virtual host.

That observation would primarily validate another control: add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. The situation calls for evidence that the probe stops reporting hostname errors and a client request reaches the correct virtual host.

Front Door cache purging invalidates stale edge copies in supported scopes. However, the option would implement use the supported Front Door purge cache operation for affected URL patterns; the scenario instead requires configure Front Door origin-group health probes and suitable priority or weight settings. The differentiating evidence is that a controlled origin outage moves new requests to the healthy alternate without client DNS reconfiguration.

Front Door WAF evaluates incoming HTTP requests at the edge before routing to origins. However, the option would implement associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns; the scenario instead requires configure Front Door origin-group health probes and suitable priority or weight settings. The differentiating evidence is that a controlled origin outage moves new requests to the healthy alternate without client DNS reconfiguration.

A route connects domain/path matching with the origin group and forwarding behavior. However, the option would implement create specific Front Door routes matching the intended domain and path patterns to origin groups; the scenario instead requires configure Front Door origin-group health probes and suitable priority or weight settings. The differentiating evidence is that a controlled origin outage moves new requests to the healthy alternate without client DNS reconfiguration.

Forwarding to an inbound endpoint from a ruleset linked to that same resolver VNet can cause a DNS loop. However, the option would implement remove a self-referential forwarding ruleset link or rule to prevent a resolver forwarding loop; the scenario instead requires separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. The differentiating evidence is that the test VNet resolves the test target while a production VNet resolves its approved production target.

Correct name resolution does not create connectivity; routing, firewall and endpoint access still matter. However, the option would implement validate DNS resolution separately from IP routing and provide an approved private network path; the scenario instead requires separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. The differentiating evidence is that the test VNet resolves the test target while a production VNet resolves its approved production target.

DNS-layer policy can block known malicious domains without treating an IP firewall allow rule as DNS security. However, the option would implement apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope; the scenario instead requires separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. The differentiating evidence is that the test VNet resolves the test target while a production VNet resolves its approved production target.

Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. However, the option would implement store NSG configurations in versioned IaC and validate effective rules before and after deployment; the scenario instead requires create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. The differentiating evidence is that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. However, the option would implement inspect effective security rules and IP flow verify for the exact source, destination, protocol and port; the scenario instead requires create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. The differentiating evidence is that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

Priority and network scope determine whether an explicit source-block rule matches before broad allows. However, the option would implement create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points; the scenario instead requires create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. The differentiating evidence is that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.