Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. However, the option would implement store NSG configurations in versioned IaC and validate effective rules before and after deployment; the scenario instead requires create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. The differentiating evidence is that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. However, the option would implement inspect effective security rules and IP flow verify for the exact source, destination, protocol and port; the scenario instead requires create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. The differentiating evidence is that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

Priority and network scope determine whether an explicit source-block rule matches before broad allows. However, the option would implement create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points; the scenario instead requires create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. The differentiating evidence is that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

That observation would primarily validate another control: use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. BFD can detect forwarding failures rapidly and inform BGP convergence where supported. The situation calls for evidence that bGP advertises the expected authorized Microsoft-service prefixes without exposing unintended routes.

That observation would primarily validate another control: deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit. An ExpressRoute circuit alone is not a VNet-to-circuit connection without the gateway or supported architecture. The situation calls for evidence that bGP advertises the expected authorized Microsoft-service prefixes without exposing unintended routes.

That observation would primarily validate another control: correct BGP route advertisements and filters so the desired prefixes propagate in both directions. ExpressRoute reachability depends on the prefixes exchanged through established peering sessions. The situation calls for evidence that bGP advertises the expected authorized Microsoft-service prefixes without exposing unintended routes.

Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. However, the option would implement assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply; the scenario instead requires resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S. The differentiating evidence is that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. However, the option would implement update the local network gateway resource with the remote VPN device public IP and correct prefixes; the scenario instead requires resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S. The differentiating evidence is that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. However, the option would implement update local network gateway address spaces or validated BGP advertisements for the missing prefix; the scenario instead requires resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S. The differentiating evidence is that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

That observation would primarily validate another control: enable the supported service endpoint on each specific subnet that requires the Azure service network identity. Service endpoints are configured at subnet level, not automatically across an entire VNet. The situation calls for evidence that allowed storage accesses succeed while attempts toward an unapproved account are blocked.

That observation would primarily validate another control: enable an appropriate virtual network service endpoint and allow the subnet in the service firewall. Service endpoints extend VNet identity to supported Azure services while service traffic uses the service's public endpoint. The situation calls for evidence that allowed storage accesses succeed while attempts toward an unapproved account are blocked.

That observation would primarily validate another control: use a private endpoint instead of a service endpoint for private-IP service access. Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. The situation calls for evidence that allowed storage accesses succeed while attempts toward an unapproved account are blocked.

Basic and Standard Virtual WAN SKUs expose different hub and connectivity capabilities. However, the option would implement select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features; the scenario instead requires configure route propagation from the branch connection into the spoke's associated route table. The differentiating evidence is that the spoke effective routes show required branch prefixes and approved application tests pass.

Virtual WAN supports specific managed NVA integrations and partner deployment requirements. However, the option would implement use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model; the scenario instead requires configure route propagation from the branch connection into the spoke's associated route table. The differentiating evidence is that the spoke effective routes show required branch prefixes and approved application tests pass.

Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. However, the option would implement deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies; the scenario instead requires configure route propagation from the branch connection into the spoke's associated route table. The differentiating evidence is that the spoke effective routes show required branch prefixes and approved application tests pass.

Layer-7 backend routing and TLS validation depend on the host and protocol settings. However, the option would implement align Application Gateway backend host-name and health-probe configuration with the origin virtual host; the scenario instead requires configure appropriate multi-site listeners and host-based routing rules on Application Gateway. The differentiating evidence is that requests with each hostname reach the intended backend while a mismatched host is rejected or handled per design.

Frontend IP and listener bindings determine which network scope can reach each Application Gateway site. However, the option would implement configure supported internal and public frontend IP configurations and bind listeners to the intended frontend; the scenario instead requires configure appropriate multi-site listeners and host-based routing rules on Application Gateway. The differentiating evidence is that requests with each hostname reach the intended backend while a mismatched host is rejected or handled per design.

Rewrite rules modify supported HTTP header and URL aspects without requiring changes in every backend service. However, the option would implement configure an Application Gateway rewrite rule set matching the required request or response conditions; the scenario instead requires configure appropriate multi-site listeners and host-based routing rules on Application Gateway. The differentiating evidence is that requests with each hostname reach the intended backend while a mismatched host is rejected or handled per design.

NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. However, the option would implement attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet; the scenario instead requires apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. The differentiating evidence is that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. However, the option would implement define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements; the scenario instead requires apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. The differentiating evidence is that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

Direct VNet peering does not resolve overlapping address-space ambiguity. However, the option would implement renumber overlapping VNet address spaces before peering or design a supported translation boundary; the scenario instead requires apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. The differentiating evidence is that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

Name resolution visibility is determined by private-zone linking and namespace selection. However, the option would implement separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links; the scenario instead requires reduce record TTL before a planned migration and validate propagation and client cache expiry. The differentiating evidence is that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. However, the option would implement enable autoregistration for the appropriate VNet link to an Azure Private DNS zone; the scenario instead requires reduce record TTL before a planned migration and validate propagation and client cache expiry. The differentiating evidence is that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

Ruleset links determine which VNets apply the conditional forwarding rules; peering alone is insufficient. However, the option would implement link the intended spoke VNet to the appropriate DNS forwarding ruleset; the scenario instead requires reduce record TTL before a planned migration and validate propagation and client cache expiry. The differentiating evidence is that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

Azure service tags abstract changing Azure service address ranges in network security rules. However, the option would implement use the appropriate Azure service tag for supported NSG destination restrictions; the scenario instead requires use Network Watcher connection testing and IP flow verify alongside service listener checks. The differentiating evidence is that the failing flow is attributed to a specific NSG decision or listener issue and the correct fix is confirmed.

NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. However, the option would implement correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering; the scenario instead requires use Network Watcher connection testing and IP flow verify alongside service listener checks. The differentiating evidence is that the failing flow is attributed to a specific NSG decision or listener issue and the correct fix is confirmed.

Direct Internet-wide RDP exposure is unnecessary when managed private administration is available. However, the option would implement use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress; the scenario instead requires use Network Watcher connection testing and IP flow verify alongside service listener checks. The differentiating evidence is that the failing flow is attributed to a specific NSG decision or listener issue and the correct fix is confirmed.

Some Private Link connections require resource-owner approval before private traffic is accepted. However, the option would implement approve the intended private endpoint connection on the target resource before testing access; the scenario instead requires check resource-specific Private Link support, subresource group IDs and regional availability before implementation. The differentiating evidence is that the selected service and group ID validate and the endpoint connection provisions successfully.

A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. However, the option would implement provide separate approved private endpoints for each consumer to the shared eligible Private Link service; the scenario instead requires check resource-specific Private Link support, subresource group IDs and regional availability before implementation. The differentiating evidence is that the selected service and group ID validate and the endpoint connection provisions successfully.

DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. However, the option would implement use individual approved private endpoint connections and enforce data-plane identity authorization; the scenario instead requires check resource-specific Private Link support, subresource group IDs and regional availability before implementation. The differentiating evidence is that the selected service and group ID validate and the endpoint connection provisions successfully.

That observation would primarily validate another control: evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. ExpressRoute Direct offers dedicated port pairs for creating supported ExpressRoute circuits at high scale. The situation calls for evidence that the BGP session reaches established state and correct advertised routes are visible.

That observation would primarily validate another control: configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. The situation calls for evidence that the BGP session reaches established state and correct advertised routes are visible.

That observation would primarily validate another control: inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. Circuit health and private peering do not guarantee a workload selects that route over more specific UDR entries. The situation calls for evidence that the BGP session reaches established state and correct advertised routes are visible.