That observation would primarily validate another control: choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed. Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. The situation calls for evidence that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

That observation would primarily validate another control: update the local network gateway resource with the remote VPN device public IP and correct prefixes. Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. The situation calls for evidence that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

That observation would primarily validate another control: deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. The situation calls for evidence that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

A private transport path is not inherently end-to-end payload encryption for compliance purposes. However, the option would implement add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate; the scenario instead requires configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. The differentiating evidence is that bGP advertises the expected authorized Microsoft-service prefixes without exposing unintended routes.

BFD can detect forwarding failures rapidly and inform BGP convergence where supported. However, the option would implement use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration; the scenario instead requires configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. The differentiating evidence is that bGP advertises the expected authorized Microsoft-service prefixes without exposing unintended routes.

ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. However, the option would implement select an ExpressRoute SKU and connectivity design that supports the needed geographic reach; the scenario instead requires configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. The differentiating evidence is that bGP advertises the expected authorized Microsoft-service prefixes without exposing unintended routes.

That observation would primarily validate another control: deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP. The inbound endpoint accepts hybrid DNS queries and can resolve private zones linked to its VNet. The situation calls for evidence that an on-premises query through the inbound endpoint returns the expected zone record rather than NXDOMAIN.

That observation would primarily validate another control: create appropriate public-zone A records for IPv4 and MX records for mail routing. DNS record types have distinct purposes: A provides IPv4 host resolution while MX selects mail exchangers. The situation calls for evidence that an on-premises query through the inbound endpoint returns the expected zone record rather than NXDOMAIN.

That observation would primarily validate another control: reduce record TTL before a planned migration and validate propagation and client cache expiry. DNS caching can delay a record change independently of network route availability. The situation calls for evidence that an on-premises query through the inbound endpoint returns the expected zone record rather than NXDOMAIN.

Azure Firewall provisioning requires its reserved subnet and adequate address capacity. However, the option would implement reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants; the scenario instead requires deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy. The differentiating evidence is that branch and spoke test egress follows the hub firewall and obeys the intended application rule.

Network rules are appropriate for transport and IP-address traffic that is not evaluated as HTTP hostnames. However, the option would implement configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination; the scenario instead requires deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy. The differentiating evidence is that branch and spoke test egress follows the hub firewall and obeys the intended application rule.

NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. However, the option would implement combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth; the scenario instead requires deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy. The differentiating evidence is that branch and spoke test egress follows the hub firewall and obeys the intended application rule.

Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. However, the option would implement configure hub gateway transit and enable use of remote gateways on the eligible spoke peering; the scenario instead requires inspect the effective-route longest-prefix match and add the proper more-specific route where supported. The differentiating evidence is that an effective-route check selects the intended specific prefix and test packets reach the right target.

A working BGP control plane does not guarantee the desired next hop when route tables override propagated paths. However, the option would implement compare effective routes and correct the conflicting UDR or route-propagation setting; the scenario instead requires inspect the effective-route longest-prefix match and add the proper more-specific route where supported. The differentiating evidence is that an effective-route check selects the intended specific prefix and test packets reach the right target.

Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. However, the option would implement define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements; the scenario instead requires inspect the effective-route longest-prefix match and add the proper more-specific route where supported. The differentiating evidence is that an effective-route check selects the intended specific prefix and test packets reach the right target.

That observation would primarily validate another control: link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path. Inbound Private Resolver resolves private zones available through its network's DNS resolution context. The situation calls for evidence that public DNS queries return the planned A address and the independent mail exchanger entries.

That observation would primarily validate another control: create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs. Private Link connectivity commonly depends on the appropriate privatelink DNS zone and VNet link. The situation calls for evidence that public DNS queries return the planned A address and the independent mail exchanger entries.

That observation would primarily validate another control: link the intended spoke VNet to the appropriate DNS forwarding ruleset. Ruleset links determine which VNets apply the conditional forwarding rules; peering alone is insufficient. The situation calls for evidence that public DNS queries return the planned A address and the independent mail exchanger entries.

That observation would primarily validate another control: enable appropriate forwarded traffic settings on the relevant peering connections and retain correct return routes. Traffic forwarded by an NVA requires compatible peering settings as well as layer-3 routing. The situation calls for evidence that the spoke effective routes include on-premises prefixes and branch application traffic passes the gateway.

That observation would primarily validate another control: apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. Forced tunneling through an appliance requires an explicit default route from the workload subnet. The situation calls for evidence that the spoke effective routes include on-premises prefixes and branch application traffic passes the gateway.

That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that the spoke effective routes include on-premises prefixes and branch application traffic passes the gateway.

Azure Firewall cannot inspect flows that routing directs around its data path. However, the option would implement associate the required UDR and validate effective routes across every protected workload subnet; the scenario instead requires enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering. The differentiating evidence is that the client and firewall resolve the intended destination consistently and matching traffic follows the expected rule.

Network rules are appropriate for transport and IP-address traffic that is not evaluated as HTTP hostnames. However, the option would implement configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination; the scenario instead requires enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering. The differentiating evidence is that the client and firewall resolve the intended destination consistently and matching traffic follows the expected rule.

Advanced IDPS and TLS inspection are Premium capabilities and require certificate and policy planning. However, the option would implement select Azure Firewall Premium and configure supported TLS inspection and IDPS settings; the scenario instead requires enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering. The differentiating evidence is that the client and firewall resolve the intended destination consistently and matching traffic follows the expected rule.

That observation would primarily validate another control: create appropriate public-zone A records for IPv4 and MX records for mail routing. DNS record types have distinct purposes: A provides IPv4 host resolution while MX selects mail exchangers. The situation calls for evidence that a newly deployed test VM appears in the zone and resolves from a permitted linked VNet.

That observation would primarily validate another control: remove a self-referential forwarding ruleset link or rule to prevent a resolver forwarding loop. Forwarding to an inbound endpoint from a ruleset linked to that same resolver VNet can cause a DNS loop. The situation calls for evidence that a newly deployed test VM appears in the zone and resolves from a permitted linked VNet.

That observation would primarily validate another control: add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace. Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. The situation calls for evidence that a newly deployed test VM appears in the zone and resolves from a permitted linked VNet.

Load Balancer health probes decide which backends are eligible for new flows. However, the option would implement configure an eligible health probe and backend listener that match the service port and NSG rules; the scenario instead requires configure suitable load-balancing rules including HA ports where the chosen internal design supports them. The differentiating evidence is that traffic to each required transport port reaches healthy backend members according to expected flow distribution.

Gateway Load Balancer integrates compatible NVAs into traffic flow without application-layer URL routing. However, the option would implement use Gateway Load Balancer and a supported transparent NVA service-chain configuration; the scenario instead requires configure suitable load-balancing rules including HA ports where the chosen internal design supports them. The differentiating evidence is that traffic to each required transport port reaches healthy backend members according to expected flow distribution.

Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. However, the option would implement configure Azure Traffic Manager with the correct routing method and endpoint health checks; the scenario instead requires configure suitable load-balancing rules including HA ports where the chosen internal design supports them. The differentiating evidence is that traffic to each required transport port reaches healthy backend members according to expected flow distribution.

That observation would primarily validate another control: add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. The situation calls for evidence that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

That observation would primarily validate another control: replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. The situation calls for evidence that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

That observation would primarily validate another control: configure HTTPS backend settings with suitable server certificate trust and host-name handling. Frontend TLS termination does not automatically encrypt the independent gateway-to-backend connection. The situation calls for evidence that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.