FastPath can improve the data path for supported ExpressRoute configurations by bypassing the gateway dataplane. However, the option would implement enable ExpressRoute FastPath on compatible circuits, gateways and network resources; the scenario instead requires select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. The differentiating evidence is that the two target regions can attach through the designed service and verify permitted test traffic.

Cloud exchange, point-to-point and other provider models have different operational and physical requirements. However, the option would implement choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning; the scenario instead requires select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. The differentiating evidence is that the two target regions can attach through the designed service and verify permitted test traffic.

BFD can detect forwarding failures rapidly and inform BGP convergence where supported. However, the option would implement use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration; the scenario instead requires select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. The differentiating evidence is that the two target regions can attach through the designed service and verify permitted test traffic.

That observation would primarily validate another control: use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. The situation calls for evidence that workload Internet egress follows the secured hub firewall and a representative policy event is logged.

That observation would primarily validate another control: deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections. Virtual WAN Standard supports centralized hub routing and expanded branch/VNet connectivity services. The situation calls for evidence that workload Internet egress follows the secured hub firewall and a representative policy event is logged.

That observation would primarily validate another control: select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features. Basic and Standard Virtual WAN SKUs expose different hub and connectivity capabilities. The situation calls for evidence that workload Internet egress follows the secured hub firewall and a representative policy event is logged.

That observation would primarily validate another control: choose the appropriate Virtual WAN hub gateway scale units and capacity parameters. Different Virtual WAN gateway types have configurable scale units and supported limits. The situation calls for evidence that branch tunnel resources connect and branch traffic reaches an approved linked VNet.

That observation would primarily validate another control: deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. The situation calls for evidence that branch tunnel resources connect and branch traffic reaches an approved linked VNet.

That observation would primarily validate another control: correct Virtual WAN route table associations and propagation labels for the connected networks. Virtual hub routing depends on the association and propagation configuration of each connection. The situation calls for evidence that branch tunnel resources connect and branch traffic reaches an approved linked VNet.

Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. However, the option would implement use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance; the scenario instead requires configure a DNAT rule with the intended public destination, private target and matching security controls. The differentiating evidence is that an external test reaches only the published internal service and unrelated ports remain inaccessible.

Azure Firewall policy evaluation order and processing rules determine which matching decision applies. However, the option would implement review Firewall Policy rule-collection-group and collection processing order and correct priorities; the scenario instead requires configure a DNAT rule with the intended public destination, private target and matching security controls. The differentiating evidence is that an external test reaches only the published internal service and unrelated ports remain inaccessible.

Hierarchical policies provide centralized baselines while allowing controlled local additions. However, the option would implement use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies; the scenario instead requires configure a DNAT rule with the intended public destination, private target and matching security controls. The differentiating evidence is that an external test reaches only the published internal service and unrelated ports remain inaccessible.

Virtual WAN supports user VPN gateways for individually authenticated client connectivity. However, the option would implement deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration; the scenario instead requires deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. The differentiating evidence is that workload Internet egress follows the secured hub firewall and a representative policy event is logged.

Basic and Standard Virtual WAN SKUs expose different hub and connectivity capabilities. However, the option would implement select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features; the scenario instead requires deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. The differentiating evidence is that workload Internet egress follows the secured hub firewall and a representative policy event is logged.

Virtual hub route-table propagation determines which connection prefixes are visible to each subscriber. However, the option would implement configure route propagation from the branch connection into the spoke's associated route table; the scenario instead requires deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. The differentiating evidence is that workload Internet egress follows the secured hub firewall and a representative policy event is logged.

NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. However, the option would implement correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering; the scenario instead requires use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. The differentiating evidence is that authorized staff connect by the approved management path and open Internet RDP tests are denied.

Azure service tags abstract changing Azure service address ranges in network security rules. However, the option would implement use the appropriate Azure service tag for supported NSG destination restrictions; the scenario instead requires use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. The differentiating evidence is that authorized staff connect by the approved management path and open Internet RDP tests are denied.

NSGs filter packet tuples at subnet or NIC scope and can restrict access by source, destination, port and protocol. However, the option would implement apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls; the scenario instead requires use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. The differentiating evidence is that authorized staff connect by the approved management path and open Internet RDP tests are denied.

DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. However, the option would implement enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs; the scenario instead requires inventory DDoS protection plan associations and protected public IP resources in governance checks. The differentiating evidence is that an inventory query flags uncovered endpoints and shows the expected protection association after correction.

Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. However, the option would implement use Defender for Cloud Cloud Security Explorer to query related security posture resources; the scenario instead requires inventory DDoS protection plan associations and protected public IP resources in governance checks. The differentiating evidence is that an inventory query flags uncovered endpoints and shows the expected protection association after correction.

Attack path analysis evaluates connected weaknesses rather than treating each network setting in isolation. However, the option would implement use Defender for Cloud attack path analysis to identify exploitable exposure chains; the scenario instead requires inventory DDoS protection plan associations and protected public IP resources in governance checks. The differentiating evidence is that an inventory query flags uncovered endpoints and shows the expected protection association after correction.

ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. However, the option would implement select an ExpressRoute SKU and connectivity design that supports the needed geographic reach; the scenario instead requires correct BGP route advertisements and filters so the desired prefixes propagate in both directions. The differentiating evidence is that both sides learn the expected prefixes and bidirectional TCP testing succeeds.

Private peering is a BGP arrangement and cannot establish with inconsistent peer identifiers or IP addressing. However, the option would implement match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters; the scenario instead requires correct BGP route advertisements and filters so the desired prefixes propagate in both directions. The differentiating evidence is that both sides learn the expected prefixes and bidirectional TCP testing succeeds.

Global Reach connects supported on-premises networks through eligible ExpressRoute circuit relationships. However, the option would implement use ExpressRoute Global Reach between eligible circuits and confirm support across their locations; the scenario instead requires correct BGP route advertisements and filters so the desired prefixes propagate in both directions. The differentiating evidence is that both sides learn the expected prefixes and bidirectional TCP testing succeeds.

That observation would primarily validate another control: configure Azure Traffic Manager with the correct routing method and endpoint health checks. Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. The situation calls for evidence that a controlled region outage directs a new eligible client flow to a healthy regional backend.

That observation would primarily validate another control: configure suitable load-balancing rules including HA ports where the chosen internal design supports them. Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. The situation calls for evidence that a controlled region outage directs a new eligible client flow to a healthy regional backend.

That observation would primarily validate another control: use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing. Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. The situation calls for evidence that a controlled region outage directs a new eligible client flow to a healthy regional backend.

Load Balancer health probes decide which backends are eligible for new flows. However, the option would implement configure an eligible health probe and backend listener that match the service port and NSG rules; the scenario instead requires configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules. The differentiating evidence is that outbound connection tests succeed at peak concurrency and the public source addresses match the plan.

Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. However, the option would implement use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing; the scenario instead requires configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules. The differentiating evidence is that outbound connection tests succeed at peak concurrency and the public source addresses match the plan.

Probe-driven backend health prevents new flows from being distributed to failing endpoints. However, the option would implement configure appropriate Load Balancer probe and rollout health gating for backend readiness; the scenario instead requires configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules. The differentiating evidence is that outbound connection tests succeed at peak concurrency and the public source addresses match the plan.

That observation would primarily validate another control: use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. The situation calls for evidence that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

That observation would primarily validate another control: deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration. Virtual WAN supports user VPN gateways for individually authenticated client connectivity. The situation calls for evidence that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

That observation would primarily validate another control: correct Virtual WAN route table associations and propagation labels for the connected networks. Virtual hub routing depends on the association and propagation configuration of each connection. The situation calls for evidence that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.