Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. However, the option would implement assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply; the scenario instead requires update the local network gateway resource with the remote VPN device public IP and correct prefixes. The differentiating evidence is that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

Gateway SKUs have deployment and capacity requirements that must be met by the dedicated reserved subnet. However, the option would implement resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU; the scenario instead requires update the local network gateway resource with the remote VPN device public IP and correct prefixes. The differentiating evidence is that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. However, the option would implement deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device; the scenario instead requires update the local network gateway resource with the remote VPN device public IP and correct prefixes. The differentiating evidence is that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. However, the option would implement configure appropriate multi-site listeners and host-based routing rules on Application Gateway; the scenario instead requires replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. The differentiating evidence is that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

URL path maps select backend targets on HTTP path matches, with default behavior for other paths. However, the option would implement configure path-based routing rules and suitable default backend pool in Application Gateway; the scenario instead requires replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. The differentiating evidence is that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. However, the option would implement add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing; the scenario instead requires replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. The differentiating evidence is that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

NSG policy evaluation sees packet addresses at its network scope rather than assuming Internet NAT addresses. However, the option would implement match NSG rules to the effective private source and destination packet addresses at the NIC boundary; the scenario instead requires configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules. The differentiating evidence is that the VM downloads through the approved egress path and an external unsolicited connection is blocked.

Security admin rules can centrally enforce network intent across managed VNet groups. However, the option would implement use Azure Virtual Network Manager security admin configurations within supported scope; the scenario instead requires configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules. The differentiating evidence is that the VM downloads through the approved egress path and an external unsolicited connection is blocked.

NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. However, the option would implement correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering; the scenario instead requires configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules. The differentiating evidence is that the VM downloads through the approved egress path and an external unsolicited connection is blocked.

That observation would primarily validate another control: sequence private endpoint approval, private DNS, connectivity testing and then public network restriction. Disabling the public endpoint before validating private name resolution and routes can cause an avoidable outage. The situation calls for evidence that unapproved endpoint requests stay pending or rejected and approved consumers connect successfully.

That observation would primarily validate another control: check resource-specific Private Link support, subresource group IDs and regional availability before implementation. Private endpoint connectivity depends on the destination service's supported private link capabilities. The situation calls for evidence that unapproved endpoint requests stay pending or rejected and approved consumers connect successfully.

That observation would primarily validate another control: restrict or disable the PaaS resource's public network access separately from creating its private endpoint. Private endpoints do not necessarily disable a service's existing public network endpoint automatically. The situation calls for evidence that unapproved endpoint requests stay pending or rejected and approved consumers connect successfully.

Aggregated network views connect resource health and relevant network signals for operations analysis. However, the option would implement use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends; the scenario instead requires use Network Watcher connectivity testing and route diagnostics from a representative Azure source. The differentiating evidence is that tests identify the blocked or misrouted hop and the restored application port connects across the hybrid path.

VPN disconnect and gateway events require historical telemetry, not only current status views. However, the option would implement collect virtual network gateway diagnostic logs and metrics into centralized monitoring; the scenario instead requires use Network Watcher connectivity testing and route diagnostics from a representative Azure source. The differentiating evidence is that tests identify the blocked or misrouted hop and the restored application port connects across the hybrid path.

Effective NSG evaluation identifies the allow or deny rule governing a specific flow. However, the option would implement use Network Watcher IP flow verify or effective security rules for the exact source/destination tuple; the scenario instead requires use Network Watcher connectivity testing and route diagnostics from a representative Azure source. The differentiating evidence is that tests identify the blocked or misrouted hop and the restored application port connects across the hybrid path.

Direct Internet-wide RDP exposure is unnecessary when managed private administration is available. However, the option would implement use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress; the scenario instead requires use the appropriate Azure service tag for supported NSG destination restrictions. The differentiating evidence is that traffic to the intended service is allowed and unrelated Internet destinations stay blocked.

Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. However, the option would implement inspect effective security rules and IP flow verify for the exact source, destination, protocol and port; the scenario instead requires use the appropriate Azure service tag for supported NSG destination restrictions. The differentiating evidence is that traffic to the intended service is allowed and unrelated Internet destinations stay blocked.

IP-prefix and application security group membership determine which NSG rules match relocated workloads. However, the option would implement update NSG source or ASG membership for the new workload placement after validating its identity; the scenario instead requires use the appropriate Azure service tag for supported NSG destination restrictions. The differentiating evidence is that traffic to the intended service is allowed and unrelated Internet destinations stay blocked.

That observation would primarily validate another control: use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources. A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. The situation calls for evidence that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

That observation would primarily validate another control: allocate a Public IP Prefix and create supported public IP resources from that prefix. Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. The situation calls for evidence that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

That observation would primarily validate another control: create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services. Gateway, Bastion, Firewall, private endpoint and application delivery components require space and specific subnet planning. The situation calls for evidence that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

That observation would primarily validate another control: define address and segmentation standards in IaC with governance checks before production deployment. Reproducible network definitions and validation catch overlapping or noncompliant ranges before live peering. The situation calls for evidence that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

That observation would primarily validate another control: create an eligible dedicated subnet and apply the delegation required by the integrating Azure service. Some platform integrations require subnet delegation and cannot coexist with arbitrary resources in that subnet. The situation calls for evidence that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

That observation would primarily validate another control: use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs. Bring-your-own-IP requires prefix validation and provisioning rather than treating any arbitrary public range as Azure owned. The situation calls for evidence that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

That observation would primarily validate another control: configure Front Door origin-group health probes and suitable priority or weight settings. Front Door origin selection depends on health probes and configured origin priority or weight. The situation calls for evidence that requests with each route pattern reach the intended origin while unmatched patterns follow the designed default.

That observation would primarily validate another control: complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. The situation calls for evidence that requests with each route pattern reach the intended origin while unmatched patterns follow the designed default.

That observation would primarily validate another control: place Front Door in front of appropriate regional origin gateways with correct host headers and probes. Front Door provides global entry and acceleration, while regional gateways retain local layer-7 capabilities. The situation calls for evidence that requests with each route pattern reach the intended origin while unmatched patterns follow the designed default.

User-defined routes direct selected prefixes through a network virtual appliance when transparent inspection is required. However, the option would implement associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop; the scenario instead requires deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. The differentiating evidence is that a drift check identifies an unauthorized default route and an approved template restores the intended path.

A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. However, the option would implement review effective routes and keep the explicit appliance route when inspected forced tunneling is required; the scenario instead requires deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. The differentiating evidence is that a drift check identifies an unauthorized default route and an approved template restores the intended path.

Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. However, the option would implement configure hub gateway transit and enable use of remote gateways on the eligible spoke peering; the scenario instead requires deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. The differentiating evidence is that a drift check identifies an unauthorized default route and an approved template restores the intended path.

VPN disconnect and gateway events require historical telemetry, not only current status views. However, the option would implement collect virtual network gateway diagnostic logs and metrics into centralized monitoring; the scenario instead requires compare Network Watcher effective routes and effective security rules for the affected NIC. The differentiating evidence is that the intended destination prefix and matching NSG allow action are visible before the application probe passes.

Connection troubleshoot evaluates the actual source-to-destination path rather than guessing from VM health status. However, the option would implement use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes; the scenario instead requires compare Network Watcher effective routes and effective security rules for the affected NIC. The differentiating evidence is that the intended destination prefix and matching NSG allow action are visible before the application probe passes.

Time-series health signals and actionable alert thresholds provide earlier detection than manual portal checks. However, the option would implement set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection; the scenario instead requires compare Network Watcher effective routes and effective security rules for the affected NIC. The differentiating evidence is that the intended destination prefix and matching NSG allow action are visible before the application probe passes.