That observation would primarily validate another control: configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. Outbound endpoints and forwarding rules let Azure-resident clients resolve selected external DNS namespaces. The situation calls for evidence that the test VNet resolves the test target while a production VNet resolves its approved production target.

That observation would primarily validate another control: create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. The situation calls for evidence that the test VNet resolves the test target while a production VNet resolves its approved production target.

That observation would primarily validate another control: create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs. Private Link connectivity commonly depends on the appropriate privatelink DNS zone and VNet link. The situation calls for evidence that the test VNet resolves the test target while a production VNet resolves its approved production target.

Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. However, the option would implement assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply; the scenario instead requires enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. The differentiating evidence is that a newly advertised test branch prefix appears in Azure learned routes and is reachable.

Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. However, the option would implement update the local network gateway resource with the remote VPN device public IP and correct prefixes; the scenario instead requires enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. The differentiating evidence is that a newly advertised test branch prefix appears in Azure learned routes and is reachable.

Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. However, the option would implement choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed; the scenario instead requires enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. The differentiating evidence is that a newly advertised test branch prefix appears in Azure learned routes and is reachable.

A private transport path is not inherently end-to-end payload encryption for compliance purposes. However, the option would implement add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate; the scenario instead requires configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. The differentiating evidence is that bGP advertises the expected authorized Microsoft-service prefixes without exposing unintended routes.

ExpressRoute reachability depends on the prefixes exchanged through established peering sessions. However, the option would implement correct BGP route advertisements and filters so the desired prefixes propagate in both directions; the scenario instead requires configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. The differentiating evidence is that bGP advertises the expected authorized Microsoft-service prefixes without exposing unintended routes.

ExpressRoute provides private connectivity through a provider path, subject to service and circuit design. However, the option would implement provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering; the scenario instead requires configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. The differentiating evidence is that bGP advertises the expected authorized Microsoft-service prefixes without exposing unintended routes.

That observation would primarily validate another control: add the selected VNet/subnet to the target service's virtual network access rules. Service endpoint enablement alone does not grant access at the PaaS service network policy layer. The situation calls for evidence that the allowed subnet accesses the service while a disallowed VNet source is rejected by resource network rules.

That observation would primarily validate another control: enable the supported service endpoint on each specific subnet that requires the Azure service network identity. Service endpoints are configured at subnet level, not automatically across an entire VNet. The situation calls for evidence that the allowed subnet accesses the service while a disallowed VNet source is rejected by resource network rules.

That observation would primarily validate another control: review service endpoint behavior and update the target service's VNet network rules rather than relying only on public egress IPs. Service endpoint traffic is governed by virtual network identity and service firewall rules. The situation calls for evidence that the allowed subnet accesses the service while a disallowed VNet source is rejected by resource network rules.

NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. However, the option would implement combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth; the scenario instead requires use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. The differentiating evidence is that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. The differentiating evidence is that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

Azure Firewall policy evaluation order and processing rules determine which matching decision applies. However, the option would implement review Firewall Policy rule-collection-group and collection processing order and correct priorities; the scenario instead requires use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. The differentiating evidence is that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

Prevention mode can block matching HTTP requests, while detection mode is nonblocking. However, the option would implement change the tuned WAF policy to prevention mode and confirm the intended managed rule action; the scenario instead requires define WAF custom geographic match rules or supported edge access controls for the target domains. The differentiating evidence is that a permitted-region test succeeds and a restricted-region test follows the configured deny response.

Front Door WAF applies application-layer filtering at the Microsoft edge for protected routes. However, the option would implement associate a Front Door WAF policy with the intended endpoint domains through a security policy; the scenario instead requires define WAF custom geographic match rules or supported edge access controls for the target domains. The differentiating evidence is that a permitted-region test succeeds and a restricted-region test follows the configured deny response.

Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. However, the option would implement start the WAF in detection mode, review matched rules and then enable prevention after tuning; the scenario instead requires define WAF custom geographic match rules or supported edge access controls for the target domains. The differentiating evidence is that a permitted-region test succeeds and a restricted-region test follows the configured deny response.

That observation would primarily validate another control: use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes. Connection troubleshoot evaluates the actual source-to-destination path rather than guessing from VM health status. The situation calls for evidence that the corrected resource recommendation clears after reassessment and its score contribution updates.

That observation would primarily validate another control: set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection. Time-series health signals and actionable alert thresholds provide earlier detection than manual portal checks. The situation calls for evidence that the corrected resource recommendation clears after reassessment and its score contribution updates.

That observation would primarily validate another control: collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes. An allow rule alone cannot establish name resolution, correct next hop and application endpoint identity. The situation calls for evidence that the corrected resource recommendation clears after reassessment and its score contribution updates.

That observation would primarily validate another control: assign a distinct nonoverlapping P2S client address pool and republish the client configuration. Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. The situation calls for evidence that a managed device establishes the expected VPN under approved triggers without manual profile entry.

That observation would primarily validate another control: choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. P2S tunnel protocol support varies by gateway settings and VPN client platform. The situation calls for evidence that a managed device establishes the expected VPN under approved triggers without manual profile entry.

That observation would primarily validate another control: regenerate and distribute the appropriate Azure VPN client configuration profile after gateway changes. Client settings must match the endpoint, routes and auth mode configured on the gateway. The situation calls for evidence that a managed device establishes the expected VPN under approved triggers without manual profile entry.

That observation would primarily validate another control: create an application security group and reference it in supported NSG rules for member network interfaces. ASGs identify groups of NICs for rule targets without hard-coding changing workload IPs. The situation calls for evidence that traffic to the intended service is allowed and unrelated Internet destinations stay blocked.

That observation would primarily validate another control: correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. The situation calls for evidence that traffic to the intended service is allowed and unrelated Internet destinations stay blocked.

That observation would primarily validate another control: create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. The situation calls for evidence that traffic to the intended service is allowed and unrelated Internet destinations stay blocked.

Gateway transit makes the shared hub VPN connection available to eligible peered spokes. However, the option would implement enable hub gateway transit and compatible remote-gateway peering usage on the spoke; the scenario instead requires assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply. The differentiating evidence is that the migration workload retains the expected address behavior and communicates within supported scope.

Gateway SKUs have deployment and capacity requirements that must be met by the dedicated reserved subnet. However, the option would implement resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU; the scenario instead requires assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply. The differentiating evidence is that the migration workload retains the expected address behavior and communicates within supported scope.

Active-active VPN gateway instances can provide redundant tunnel paths when peer devices support the design. However, the option would implement configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints; the scenario instead requires assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply. The differentiating evidence is that the migration workload retains the expected address behavior and communicates within supported scope.

A missing application log can result from network filtering or an unavailable listener; both need evidence. However, the option would implement use Network Watcher connection testing and IP flow verify alongside service listener checks; the scenario instead requires use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. The differentiating evidence is that authorized staff connect by the approved management path and open Internet RDP tests are denied.

An unattached NSG does not evaluate workload traffic merely because its resource exists. However, the option would implement associate the NSG with the actual target subnet or network interface and validate effective policy; the scenario instead requires use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. The differentiating evidence is that authorized staff connect by the approved management path and open Internet RDP tests are denied.

Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. However, the option would implement create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route; the scenario instead requires use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. The differentiating evidence is that authorized staff connect by the approved management path and open Internet RDP tests are denied.