That observation would primarily validate another control: add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. The situation calls for evidence that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

That observation would primarily validate another control: replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. The situation calls for evidence that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

That observation would primarily validate another control: configure HTTPS backend settings with suitable server certificate trust and host-name handling. Frontend TLS termination does not automatically encrypt the independent gateway-to-backend connection. The situation calls for evidence that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

That observation would primarily validate another control: plan consistent private DNS zone links or resolver forwarding across the client VNets. Private DNS zone visibility follows VNet links and resolution architecture, not merely peering topology. The situation calls for evidence that unapproved endpoint requests stay pending or rejected and approved consumers connect successfully.

That observation would primarily validate another control: publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints. Private Link service exposes a provider-hosted private service to consumer private endpoints. The situation calls for evidence that unapproved endpoint requests stay pending or rejected and approved consumers connect successfully.

That observation would primarily validate another control: verify the service's VNet integration outbound route and private DNS configuration in the integration environment. The caller's own network integration and resolver path control whether it can use a private endpoint. The situation calls for evidence that unapproved endpoint requests stay pending or rejected and approved consumers connect successfully.

That observation would primarily validate another control: enable hub gateway transit and compatible remote-gateway peering usage on the spoke. Gateway transit makes the shared hub VPN connection available to eligible peered spokes. The situation calls for evidence that iKE negotiation succeeds and protected test packets traverse the established IPsec security association.

That observation would primarily validate another control: update local network gateway address spaces or validated BGP advertisements for the missing prefix. A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. The situation calls for evidence that iKE negotiation succeeds and protected test packets traverse the established IPsec security association.

That observation would primarily validate another control: update the local network gateway resource with the remote VPN device public IP and correct prefixes. Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. The situation calls for evidence that iKE negotiation succeeds and protected test packets traverse the established IPsec security association.

Broad WAF exclusions create avoidable blind spots while a targeted exception can preserve other detection coverage. However, the option would implement limit WAF exclusions to the smallest required match variable, field or rule; the scenario instead requires start the WAF in detection mode, review matched rules and then enable prevention after tuning. The differentiating evidence is that approved test requests produce WAF logs in detection and are appropriately blocked in prevention after tuning.

Targeted tuning preserves the broader managed rule set while addressing a justified false positive. However, the option would implement apply a narrowly scoped WAF exclusion or supported per-rule override instead of disabling all protection; the scenario instead requires start the WAF in detection mode, review matched rules and then enable prevention after tuning. The differentiating evidence is that approved test requests produce WAF logs in detection and are appropriately blocked in prevention after tuning.

Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. However, the option would implement use WAF diagnostic logs to identify matched policy, rule and client/request details; the scenario instead requires start the WAF in detection mode, review matched rules and then enable prevention after tuning. The differentiating evidence is that approved test requests produce WAF logs in detection and are appropriately blocked in prevention after tuning.

BFD can detect forwarding failures rapidly and inform BGP convergence where supported. However, the option would implement use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration; the scenario instead requires use ExpressRoute Global Reach between eligible circuits and confirm support across their locations. The differentiating evidence is that a branch-to-branch route and packet trace traverse the intended Global Reach path.

A private transport path is not inherently end-to-end payload encryption for compliance purposes. However, the option would implement add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate; the scenario instead requires use ExpressRoute Global Reach between eligible circuits and confirm support across their locations. The differentiating evidence is that a branch-to-branch route and packet trace traverse the intended Global Reach path.

An ExpressRoute circuit alone is not a VNet-to-circuit connection without the gateway or supported architecture. However, the option would implement deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit; the scenario instead requires use ExpressRoute Global Reach between eligible circuits and confirm support across their locations. The differentiating evidence is that a branch-to-branch route and packet trace traverse the intended Global Reach path.

Edge origin health assessment should use a consistently reachable probe without costly application side effects. However, the option would implement configure an appropriate lightweight unauthenticated Front Door origin health probe path; the scenario instead requires create specific Front Door routes matching the intended domain and path patterns to origin groups. The differentiating evidence is that requests with each route pattern reach the intended origin while unmatched patterns follow the designed default.

Private Link origin connectivity requires accepted connection state and valid private endpoint/DNS behavior. However, the option would implement approve the required private endpoint connection and verify the origin's private link health; the scenario instead requires create specific Front Door routes matching the intended domain and path patterns to origin groups. The differentiating evidence is that requests with each route pattern reach the intended origin while unmatched patterns follow the designed default.

Public origins need defenses against clients bypassing edge WAF and delivery rules. However, the option would implement apply supported origin access restrictions using Front Door identification and approved security controls; the scenario instead requires create specific Front Door routes matching the intended domain and path patterns to origin groups. The differentiating evidence is that requests with each route pattern reach the intended origin while unmatched patterns follow the designed default.

RADIUS authentication depends on an accessible server and consistent protocol/authentication configuration. However, the option would implement configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets; the scenario instead requires choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. The differentiating evidence is that clients on approved platforms negotiate the selected tunnel and connect to the allowed subnet.

Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. However, the option would implement select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication; the scenario instead requires choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. The differentiating evidence is that clients on approved platforms negotiate the selected tunnel and connect to the allowed subnet.

Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. However, the option would implement assign a distinct nonoverlapping P2S client address pool and republish the client configuration; the scenario instead requires choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. The differentiating evidence is that clients on approved platforms negotiate the selected tunnel and connect to the allowed subnet.

Front Door is a globally distributed application delivery service that proxies and routes HTTP(S) traffic to healthy origins. However, the option would implement deploy Azure Front Door with appropriate origin groups and endpoint routes; the scenario instead requires place Front Door in front of appropriate regional origin gateways with correct host headers and probes. The differentiating evidence is that a distant client uses the edge address and backend logs show correct host-based routing through the regional gateway.

Front Door origin selection depends on health probes and configured origin priority or weight. However, the option would implement configure Front Door origin-group health probes and suitable priority or weight settings; the scenario instead requires place Front Door in front of appropriate regional origin gateways with correct host headers and probes. The differentiating evidence is that a distant client uses the edge address and backend logs show correct host-based routing through the regional gateway.

Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. However, the option would implement use supported Front Door rules and geographic filtering where appropriate, plus origin segregation; the scenario instead requires place Front Door in front of appropriate regional origin gateways with correct host headers and probes. The differentiating evidence is that a distant client uses the edge address and backend logs show correct host-based routing through the regional gateway.

That observation would primarily validate another control: deploy Azure Application Gateway with HTTPS listener and path-based routing rules. Application Gateway provides regional layer-7 routing and TLS termination for HTTP services. The situation calls for evidence that an approved safe test payload produces a matching WAF log action without blocking normal transactions.

That observation would primarily validate another control: configure HTTPS backend settings with suitable server certificate trust and host-name handling. Frontend TLS termination does not automatically encrypt the independent gateway-to-backend connection. The situation calls for evidence that an approved safe test payload produces a matching WAF log action without blocking normal transactions.

That observation would primarily validate another control: configure an Application Gateway redirect configuration associated with the right listener or rule. HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. The situation calls for evidence that an approved safe test payload produces a matching WAF log action without blocking normal transactions.

Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. However, the option would implement reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility; the scenario instead requires allocate a Public IP Prefix and create supported public IP resources from that prefix. The differentiating evidence is that the allocated public IP resources fall inside the reserved prefix and attach to intended front-end resources.

IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. However, the option would implement add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends; the scenario instead requires allocate a Public IP Prefix and create supported public IP resources from that prefix. The differentiating evidence is that the allocated public IP resources fall inside the reserved prefix and attach to intended front-end resources.

Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. However, the option would implement create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet; the scenario instead requires allocate a Public IP Prefix and create supported public IP resources from that prefix. The differentiating evidence is that the allocated public IP resources fall inside the reserved prefix and attach to intended front-end resources.

Virtual hub routing depends on the association and propagation configuration of each connection. However, the option would implement correct Virtual WAN route table associations and propagation labels for the connected networks; the scenario instead requires check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions. The differentiating evidence is that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

Virtual hub route-table propagation determines which connection prefixes are visible to each subscriber. However, the option would implement configure route propagation from the branch connection into the spoke's associated route table; the scenario instead requires check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions. The differentiating evidence is that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. However, the option would implement design Virtual WAN traffic security explicitly with compatible firewall and routing features; the scenario instead requires check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions. The differentiating evidence is that a permitted cross-region flow follows the intended hub path and is returned symmetrically.