Virtual hub routing depends on the association and propagation configuration of each connection. However, the option would implement correct Virtual WAN route table associations and propagation labels for the connected networks; the scenario instead requires check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions. The differentiating evidence is that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

Virtual hub route-table propagation determines which connection prefixes are visible to each subscriber. However, the option would implement configure route propagation from the branch connection into the spoke's associated route table; the scenario instead requires check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions. The differentiating evidence is that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. However, the option would implement design Virtual WAN traffic security explicitly with compatible firewall and routing features; the scenario instead requires check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions. The differentiating evidence is that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

That observation would primarily validate another control: start the WAF in detection mode, review matched rules and then enable prevention after tuning. Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. The situation calls for evidence that an approved safe injection test produces a managed rule match while ordinary requests remain available.

That observation would primarily validate another control: scope and associate appropriate WAF security policies to supported domains or path patterns. WAF policy association and custom rule match conditions determine where application-layer controls apply. The situation calls for evidence that an approved safe injection test produces a managed rule match while ordinary requests remain available.

That observation would primarily validate another control: use WAF diagnostic logs to identify matched policy, rule and client/request details. Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. The situation calls for evidence that an approved safe injection test produces a managed rule match while ordinary requests remain available.

That observation would primarily validate another control: configure a DNAT rule with the intended public destination, private target and matching security controls. Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. The situation calls for evidence that branch and spoke test egress follows the hub firewall and obeys the intended application rule.

That observation would primarily validate another control: correlate firewall decision logs with source and destination effective routes and return connectivity. A rule allow is not sufficient when a request or response never passes the expected firewall path. The situation calls for evidence that branch and spoke test egress follows the hub firewall and obeys the intended application rule.

That observation would primarily validate another control: configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination. Network rules are appropriate for transport and IP-address traffic that is not evaluated as HTTP hostnames. The situation calls for evidence that branch and spoke test egress follows the hub firewall and obeys the intended application rule.

That observation would primarily validate another control: plan internal private DNS zones and public DNS hosting as distinct authoritative resolution scopes. Public Azure DNS zones and private DNS zones have different visibility and delegation semantics. The situation calls for evidence that queries from the newly linked spoke reach the rule target and resolve a test corporate hostname.

That observation would primarily validate another control: deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP. The inbound endpoint accepts hybrid DNS queries and can resolve private zones linked to its VNet. The situation calls for evidence that queries from the newly linked spoke reach the rule target and resolve a test corporate hostname.

That observation would primarily validate another control: link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path. Inbound Private Resolver resolves private zones available through its network's DNS resolution context. The situation calls for evidence that queries from the newly linked spoke reach the rule target and resolve a test corporate hostname.

That observation would primarily validate another control: update the local network gateway resource with the remote VPN device public IP and correct prefixes. Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. The situation calls for evidence that a controlled single-tunnel interruption leaves the alternate tunnel carrying authorized network traffic.

That observation would primarily validate another control: enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. BGP distributes network prefixes across compatible VPN peers, avoiding repeated manual network updates. The situation calls for evidence that a controlled single-tunnel interruption leaves the alternate tunnel carrying authorized network traffic.

That observation would primarily validate another control: update local network gateway address spaces or validated BGP advertisements for the missing prefix. A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. The situation calls for evidence that a controlled single-tunnel interruption leaves the alternate tunnel carrying authorized network traffic.

The inbound endpoint accepts hybrid DNS queries and can resolve private zones linked to its VNet. However, the option would implement deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP; the scenario instead requires configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. The differentiating evidence is that a client in a linked VNet resolves the office-only record through the approved target DNS servers.

Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. However, the option would implement enable autoregistration for the appropriate VNet link to an Azure Private DNS zone; the scenario instead requires configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. The differentiating evidence is that a client in a linked VNet resolves the office-only record through the approved target DNS servers.

Inbound Private Resolver resolves private zones available through its network's DNS resolution context. However, the option would implement link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path; the scenario instead requires configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. The differentiating evidence is that a client in a linked VNet resolves the office-only record through the approved target DNS servers.

That observation would primarily validate another control: configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. The situation calls for evidence that a branch-to-branch route and packet trace traverse the intended Global Reach path.

That observation would primarily validate another control: inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. Circuit health and private peering do not guarantee a workload selects that route over more specific UDR entries. The situation calls for evidence that a branch-to-branch route and packet trace traverse the intended Global Reach path.

That observation would primarily validate another control: use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. BFD can detect forwarding failures rapidly and inform BGP convergence where supported. The situation calls for evidence that a branch-to-branch route and packet trace traverse the intended Global Reach path.

That observation would primarily validate another control: remove or reject only the obsolete private endpoint connection and clean up its DNS records. Private Link consumer connections can be managed individually without deleting the underlying PaaS resource. The situation calls for evidence that test clients in every approved spoke resolve the correct endpoint IPs.

That observation would primarily validate another control: use individual approved private endpoint connections and enforce data-plane identity authorization. DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. The situation calls for evidence that test clients in every approved spoke resolve the correct endpoint IPs.

That observation would primarily validate another control: restrict or disable the PaaS resource's public network access separately from creating its private endpoint. Private endpoints do not necessarily disable a service's existing public network endpoint automatically. The situation calls for evidence that test clients in every approved spoke resolve the correct endpoint IPs.

A DDoS plan or protection policy only helps resources properly associated within its supported scope. However, the option would implement inventory DDoS protection plan associations and protected public IP resources in governance checks; the scenario instead requires collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes. The differentiating evidence is that the investigation reports the actual DNS target, path and application response and isolates the failed dependency.

Backend availability depends on probe reachability and network/security rules, not simply process existence. However, the option would implement inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing; the scenario instead requires collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes. The differentiating evidence is that the investigation reports the actual DNS target, path and application response and isolates the failed dependency.

Attack path analysis evaluates connected weaknesses rather than treating each network setting in isolation. However, the option would implement use Defender for Cloud attack path analysis to identify exploitable exposure chains; the scenario instead requires collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes. The differentiating evidence is that the investigation reports the actual DNS target, path and application response and isolates the failed dependency.

DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. However, the option would implement use individual approved private endpoint connections and enforce data-plane identity authorization; the scenario instead requires review and configure supported private endpoint network policies and the associated subnet routes deliberately. The differentiating evidence is that a representative approved flow reaches the endpoint through the intended path and denied flows are blocked.

Disabling the public endpoint before validating private name resolution and routes can cause an avoidable outage. However, the option would implement sequence private endpoint approval, private DNS, connectivity testing and then public network restriction; the scenario instead requires review and configure supported private endpoint network policies and the associated subnet routes deliberately. The differentiating evidence is that a representative approved flow reaches the endpoint through the intended path and denied flows are blocked.

Private Link consumer connections can be managed individually without deleting the underlying PaaS resource. However, the option would implement remove or reject only the obsolete private endpoint connection and clean up its DNS records; the scenario instead requires review and configure supported private endpoint network policies and the associated subnet routes deliberately. The differentiating evidence is that a representative approved flow reaches the endpoint through the intended path and denied flows are blocked.

Load balancing applies only to members registered in its backend pool and passing health checks. However, the option would implement register eligible NIC IP configurations or supported resources in the load balancer backend pool; the scenario instead requires use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing. The differentiating evidence is that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

Weighted Traffic Manager policies influence DNS answer distribution across eligible healthy endpoints. However, the option would implement configure Traffic Manager Weighted routing across the regional endpoints; the scenario instead requires use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing. The differentiating evidence is that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. However, the option would implement configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules; the scenario instead requires use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing. The differentiating evidence is that distinct URL paths arrive at the specified backend pools without separate client-facing ports.