That observation would primarily validate another control: link the intended spoke VNet to the appropriate DNS forwarding ruleset. Ruleset links determine which VNets apply the conditional forwarding rules; peering alone is insufficient. The situation calls for evidence that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

That observation would primarily validate another control: reduce record TTL before a planned migration and validate propagation and client cache expiry. DNS caching can delay a record change independently of network route availability. The situation calls for evidence that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

That observation would primarily validate another control: validate DNS resolution separately from IP routing and provide an approved private network path. Correct name resolution does not create connectivity; routing, firewall and endpoint access still matter. The situation calls for evidence that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

That observation would primarily validate another control: configure appropriate Load Balancer probe and rollout health gating for backend readiness. Probe-driven backend health prevents new flows from being distributed to failing endpoints. The situation calls for evidence that after the TTL window, fresh queries resolve to the healthy selected endpoint and the standby service responds.

That observation would primarily validate another control: configure Azure Traffic Manager with the correct routing method and endpoint health checks. Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. The situation calls for evidence that after the TTL window, fresh queries resolve to the healthy selected endpoint and the standby service responds.

That observation would primarily validate another control: use Gateway Load Balancer and a supported transparent NVA service-chain configuration. Gateway Load Balancer integrates compatible NVAs into traffic flow without application-layer URL routing. The situation calls for evidence that after the TTL window, fresh queries resolve to the healthy selected endpoint and the standby service responds.

That observation would primarily validate another control: add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace. Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. The situation calls for evidence that on-premises nslookup against the conditional forwarder returns the expected Azure private address.

That observation would primarily validate another control: apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. DNS-layer policy can block known malicious domains without treating an IP firewall allow rule as DNS security. The situation calls for evidence that on-premises nslookup against the conditional forwarder returns the expected Azure private address.

That observation would primarily validate another control: create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints. Inbound and outbound resolver endpoints use dedicated subnets that cannot host unrelated workloads. The situation calls for evidence that on-premises nslookup against the conditional forwarder returns the expected Azure private address.

Gateway transit makes the shared hub VPN connection available to eligible peered spokes. However, the option would implement enable hub gateway transit and compatible remote-gateway peering usage on the spoke; the scenario instead requires design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. The differentiating evidence is that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

Gateway SKUs have deployment and capacity requirements that must be met by the dedicated reserved subnet. However, the option would implement resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU; the scenario instead requires design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. The differentiating evidence is that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. However, the option would implement align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN; the scenario instead requires design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. The differentiating evidence is that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

That observation would primarily validate another control: use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. Hierarchical policies provide centralized baselines while allowing controlled local additions. The situation calls for evidence that the intended Azure service stays reachable after endpoint changes without permitting unrelated public destinations.

That observation would primarily validate another control: deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy. Secured virtual hubs support managed firewall enforcement for connected traffic when routing is configured. The situation calls for evidence that the intended Azure service stays reachable after endpoint changes without permitting unrelated public destinations.

That observation would primarily validate another control: correlate firewall decision logs with source and destination effective routes and return connectivity. A rule allow is not sufficient when a request or response never passes the expected firewall path. The situation calls for evidence that the intended Azure service stays reachable after endpoint changes without permitting unrelated public destinations.

BGP distributes network prefixes across compatible VPN peers, avoiding repeated manual network updates. However, the option would implement enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements; the scenario instead requires resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU. The differentiating evidence is that the selected gateway instance scales successfully and its associated VPN remains healthy.

Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. However, the option would implement update the local network gateway resource with the remote VPN device public IP and correct prefixes; the scenario instead requires resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU. The differentiating evidence is that the selected gateway instance scales successfully and its associated VPN remains healthy.

Tunnel control-plane status and Azure data-plane next-hop selection are separate conditions. However, the option would implement check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes; the scenario instead requires resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU. The differentiating evidence is that the selected gateway instance scales successfully and its associated VPN remains healthy.

Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. However, the option would implement publish only the eligible Private Link service target with appropriate access policy rather than VNet peering; the scenario instead requires publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints. The differentiating evidence is that an approved consumer endpoint reaches the service while an unapproved connection remains denied.

Private DNS zone visibility follows VNet links and resolution architecture, not merely peering topology. However, the option would implement plan consistent private DNS zone links or resolver forwarding across the client VNets; the scenario instead requires publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints. The differentiating evidence is that an approved consumer endpoint reaches the service while an unapproved connection remains denied.

Private endpoints do not necessarily disable a service's existing public network endpoint automatically. However, the option would implement restrict or disable the PaaS resource's public network access separately from creating its private endpoint; the scenario instead requires publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints. The differentiating evidence is that an approved consumer endpoint reaches the service while an unapproved connection remains denied.

Virtual hub routing depends on the association and propagation configuration of each connection. However, the option would implement correct Virtual WAN route table associations and propagation labels for the connected networks; the scenario instead requires deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings. The differentiating evidence is that branch tunnel resources connect and branch traffic reaches an approved linked VNet.

Different Virtual WAN gateway types have configurable scale units and supported limits. However, the option would implement choose the appropriate Virtual WAN hub gateway scale units and capacity parameters; the scenario instead requires deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings. The differentiating evidence is that branch tunnel resources connect and branch traffic reaches an approved linked VNet.

Virtual WAN hub interconnect and route propagation control cross-region VNet path availability. However, the option would implement check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions; the scenario instead requires deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings. The differentiating evidence is that branch tunnel resources connect and branch traffic reaches an approved linked VNet.

That observation would primarily validate another control: remove or reject only the obsolete private endpoint connection and clean up its DNS records. Private Link consumer connections can be managed individually without deleting the underlying PaaS resource. The situation calls for evidence that the application passes private-path tests before public ingress is disabled and stays healthy afterward.

That observation would primarily validate another control: restrict or disable the PaaS resource's public network access separately from creating its private endpoint. Private endpoints do not necessarily disable a service's existing public network endpoint automatically. The situation calls for evidence that the application passes private-path tests before public ingress is disabled and stays healthy afterward.

That observation would primarily validate another control: publish only the eligible Private Link service target with appropriate access policy rather than VNet peering. Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. The situation calls for evidence that the application passes private-path tests before public ingress is disabled and stays healthy afterward.

Route Server exchanges BGP information with compatible appliances and Azure networking instead of relying on static edits. However, the option would implement use Azure Route Server with a supported BGP peer to exchange routes dynamically; the scenario instead requires design an explicit routed transit path using an NVA or supported hub routing architecture. The differentiating evidence is that a probe between spokes follows the approved transit hop and reverse traffic returns over a valid path.

Centralized change definitions make route and topology deviations detectable before deployment. However, the option would implement deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations; the scenario instead requires design an explicit routed transit path using an NVA or supported hub routing architecture. The differentiating evidence is that a probe between spokes follows the approved transit hop and reverse traffic returns over a valid path.

NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. However, the option would implement attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet; the scenario instead requires design an explicit routed transit path using an NVA or supported hub routing architecture. The differentiating evidence is that a probe between spokes follows the approved transit hop and reverse traffic returns over a valid path.

That observation would primarily validate another control: add the selected VNet/subnet to the target service's virtual network access rules. Service endpoint enablement alone does not grant access at the PaaS service network policy layer. The situation calls for evidence that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

That observation would primarily validate another control: keep normal public service DNS and validate service endpoint route and subnet network-rule behavior. Service endpoints do not change a service FQDN into a consumer private endpoint address. The situation calls for evidence that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

That observation would primarily validate another control: choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. The situation calls for evidence that an authorized user on the subnet can read approved data while an unauthorized identity is denied.