That observation would primarily validate another control: use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. The situation calls for evidence that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

That observation would primarily validate another control: deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration. Virtual WAN supports user VPN gateways for individually authenticated client connectivity. The situation calls for evidence that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

That observation would primarily validate another control: correct Virtual WAN route table associations and propagation labels for the connected networks. Virtual hub routing depends on the association and propagation configuration of each connection. The situation calls for evidence that the NVA connects to intended hub routes and approved branch flows are inspected and delivered.

Azure Firewall provisioning requires its reserved subnet and adequate address capacity. However, the option would implement reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants; the scenario instead requires choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost. The differentiating evidence is that selected firewall tier supports required rules and monitored traffic stays within capacity.

Hierarchical policies provide centralized baselines while allowing controlled local additions. However, the option would implement use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies; the scenario instead requires choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost. The differentiating evidence is that selected firewall tier supports required rules and monitored traffic stays within capacity.

Azure Firewall policy evaluation order and processing rules determine which matching decision applies. However, the option would implement review Firewall Policy rule-collection-group and collection processing order and correct priorities; the scenario instead requires choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost. The differentiating evidence is that selected firewall tier supports required rules and monitored traffic stays within capacity.

That observation would primarily validate another control: enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment. New NSG flow logs are no longer supported; VNet flow logs are the recommended replacement. The situation calls for evidence that authorized staff connect by the approved management path and open Internet RDP tests are denied.

That observation would primarily validate another control: configure supported private endpoint network-policy settings and relevant NSG rules where enabled. Private endpoint NSG and UDR enforcement depends on subnet network policy configuration. The situation calls for evidence that authorized staff connect by the approved management path and open Internet RDP tests are denied.

That observation would primarily validate another control: create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. The situation calls for evidence that authorized staff connect by the approved management path and open Internet RDP tests are denied.

BFD can detect forwarding failures rapidly and inform BGP convergence where supported. However, the option would implement use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration; the scenario instead requires correct BGP route advertisements and filters so the desired prefixes propagate in both directions. The differentiating evidence is that both sides learn the expected prefixes and bidirectional TCP testing succeeds.

Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. However, the option would implement configure Microsoft peering only for eligible services and with the required prefix authorization and route filters; the scenario instead requires correct BGP route advertisements and filters so the desired prefixes propagate in both directions. The differentiating evidence is that both sides learn the expected prefixes and bidirectional TCP testing succeeds.

Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. However, the option would implement design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections; the scenario instead requires correct BGP route advertisements and filters so the desired prefixes propagate in both directions. The differentiating evidence is that both sides learn the expected prefixes and bidirectional TCP testing succeeds.

Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. However, the option would implement choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed; the scenario instead requires check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes. The differentiating evidence is that the packet path is identified and a corrected route sends traffic over the intended active tunnel.

A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. However, the option would implement update local network gateway address spaces or validated BGP advertisements for the missing prefix; the scenario instead requires check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes. The differentiating evidence is that the packet path is identified and a corrected route sends traffic over the intended active tunnel.

A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. However, the option would implement deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device; the scenario instead requires check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes. The differentiating evidence is that the packet path is identified and a corrected route sends traffic over the intended active tunnel.

Healthy connection resources do not prove application reachability across security and routing boundaries. However, the option would implement use Network Watcher connectivity testing and route diagnostics from a representative Azure source; the scenario instead requires use Defender for Cloud attack path analysis to identify exploitable exposure chains. The differentiating evidence is that the documented risky path is no longer present after remediating its actual exposure edge.

Backend availability depends on probe reachability and network/security rules, not simply process existence. However, the option would implement inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing; the scenario instead requires use Defender for Cloud attack path analysis to identify exploitable exposure chains. The differentiating evidence is that the documented risky path is no longer present after remediating its actual exposure edge.

Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. However, the option would implement use Defender for Cloud Cloud Security Explorer to query related security posture resources; the scenario instead requires use Defender for Cloud attack path analysis to identify exploitable exposure chains. The differentiating evidence is that the documented risky path is no longer present after remediating its actual exposure edge.

That observation would primarily validate another control: design Virtual WAN traffic security explicitly with compatible firewall and routing features. Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. The situation calls for evidence that branch tunnel resources connect and branch traffic reaches an approved linked VNet.

That observation would primarily validate another control: provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits. Virtual WAN gateway components are service-specific; S2S VPN gateway does not terminate ExpressRoute. The situation calls for evidence that branch tunnel resources connect and branch traffic reaches an approved linked VNet.

That observation would primarily validate another control: check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions. Virtual WAN hub interconnect and route propagation control cross-region VNet path availability. The situation calls for evidence that branch tunnel resources connect and branch traffic reaches an approved linked VNet.

That observation would primarily validate another control: choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. The situation calls for evidence that the allowed subnet accesses the service while a disallowed VNet source is rejected by resource network rules.

That observation would primarily validate another control: allow the intended service-tag destination and necessary outbound flow in subnet security controls. Service endpoint routing does not bypass independent NSG or resource firewall enforcement. The situation calls for evidence that the allowed subnet accesses the service while a disallowed VNet source is rejected by resource network rules.

That observation would primarily validate another control: add the selected VNet/subnet to the target service's virtual network access rules. Service endpoint enablement alone does not grant access at the PaaS service network policy layer. The situation calls for evidence that the allowed subnet accesses the service while a disallowed VNet source is rejected by resource network rules.

VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. However, the option would implement create purpose-specific subnets in the VNet and apply matching network security and routing controls; the scenario instead requires create an eligible dedicated subnet and apply the delegation required by the integrating Azure service. The differentiating evidence is that the service integration deploys into the delegated subnet and private downstream connections succeed.

Connected peers and gateways must recognize updated prefixes and traffic cannot rely on stale addressing during migration. However, the option would implement plan address-space updates with peering synchronization and dependency validation before routing cutover; the scenario instead requires create an eligible dedicated subnet and apply the delegation required by the integrating Azure service. The differentiating evidence is that the service integration deploys into the delegated subnet and private downstream connections succeed.

Reproducible network definitions and validation catch overlapping or noncompliant ranges before live peering. However, the option would implement define address and segmentation standards in IaC with governance checks before production deployment; the scenario instead requires create an eligible dedicated subnet and apply the delegation required by the integrating Azure service. The differentiating evidence is that the service integration deploys into the delegated subnet and private downstream connections succeed.

That observation would primarily validate another control: design an explicit routed transit path using an NVA or supported hub routing architecture. VNet peering is not intrinsically transitive; a route or gateway strategy is required for spoke-to-spoke transit. The situation calls for evidence that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

That observation would primarily validate another control: inspect the effective-route longest-prefix match and add the proper more-specific route where supported. Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. The situation calls for evidence that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

That observation would primarily validate another control: configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. Outbound endpoints and forwarding rules let Azure-resident clients resolve selected external DNS namespaces. The situation calls for evidence that the test VNet resolves the test target while a production VNet resolves its approved production target.

That observation would primarily validate another control: create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. The situation calls for evidence that the test VNet resolves the test target while a production VNet resolves its approved production target.

That observation would primarily validate another control: create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs. Private Link connectivity commonly depends on the appropriate privatelink DNS zone and VNet link. The situation calls for evidence that the test VNet resolves the test target while a production VNet resolves its approved production target.