Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. However, the option would implement reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility; the scenario instead requires allocate a Public IP Prefix and create supported public IP resources from that prefix. The differentiating evidence is that the allocated public IP resources fall inside the reserved prefix and attach to intended front-end resources.

Outbound connectivity does not require each backend NIC to carry a public address or accept inbound traffic. However, the option would implement use private backend addressing and implement egress separately through a controlled outbound path; the scenario instead requires allocate a Public IP Prefix and create supported public IP resources from that prefix. The differentiating evidence is that the allocated public IP resources fall inside the reserved prefix and attach to intended front-end resources.

VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. However, the option would implement create purpose-specific subnets in the VNet and apply matching network security and routing controls; the scenario instead requires allocate a Public IP Prefix and create supported public IP resources from that prefix. The differentiating evidence is that the allocated public IP resources fall inside the reserved prefix and attach to intended front-end resources.

That observation would primarily validate another control: enable hub gateway transit and compatible remote-gateway peering usage on the spoke. Gateway transit makes the shared hub VPN connection available to eligible peered spokes. The situation calls for evidence that gateway metrics under a representative load remain within capacity and redundant branch paths stay connected.

That observation would primarily validate another control: configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints. Active-active VPN gateway instances can provide redundant tunnel paths when peer devices support the design. The situation calls for evidence that gateway metrics under a representative load remain within capacity and redundant branch paths stay connected.

That observation would primarily validate another control: deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. The situation calls for evidence that gateway metrics under a representative load remain within capacity and redundant branch paths stay connected.

Virtual hub route-table propagation determines which connection prefixes are visible to each subscriber. However, the option would implement configure route propagation from the branch connection into the spoke's associated route table; the scenario instead requires deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration. The differentiating evidence is that a permitted remote user establishes a client tunnel and reaches the assigned resource route.

Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. However, the option would implement use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation; the scenario instead requires deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration. The differentiating evidence is that a permitted remote user establishes a client tunnel and reaches the assigned resource route.

Different Virtual WAN gateway types have configurable scale units and supported limits. However, the option would implement choose the appropriate Virtual WAN hub gateway scale units and capacity parameters; the scenario instead requires deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration. The differentiating evidence is that a permitted remote user establishes a client tunnel and reaches the assigned resource route.

That observation would primarily validate another control: verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately. Moving to Private Link requires validating both name resolution and authorization before retiring former service access. The situation calls for evidence that the service firewall sees the allowed VNet/subnet and rejects requests from unapproved networks.

That observation would primarily validate another control: add the selected VNet/subnet to the target service's virtual network access rules. Service endpoint enablement alone does not grant access at the PaaS service network policy layer. The situation calls for evidence that the service firewall sees the allowed VNet/subnet and rejects requests from unapproved networks.

That observation would primarily validate another control: review service endpoint behavior and update the target service's VNet network rules rather than relying only on public egress IPs. Service endpoint traffic is governed by virtual network identity and service firewall rules. The situation calls for evidence that the service firewall sees the allowed VNet/subnet and rejects requests from unapproved networks.

An HTTP-to-HTTPS redirect moves the client to a TLS endpoint rather than serving sensitive content over HTTP. However, the option would implement configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway; the scenario instead requires replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. The differentiating evidence is that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

Application Gateway provides regional layer-7 routing and TLS termination for HTTP services. However, the option would implement deploy Azure Application Gateway with HTTPS listener and path-based routing rules; the scenario instead requires replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. The differentiating evidence is that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

Application Gateway has subnet placement and IP capacity requirements distinct from backend pools. However, the option would implement move the gateway into a supported dedicated subnet with adequate addresses for expected scaling; the scenario instead requires replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. The differentiating evidence is that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

That observation would primarily validate another control: validate DNS resolution separately from IP routing and provide an approved private network path. Correct name resolution does not create connectivity; routing, firewall and endpoint access still matter. The situation calls for evidence that lookups through the VNet's configured DNS server return private endpoint addresses for the zone suffix.

That observation would primarily validate another control: link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path. Inbound Private Resolver resolves private zones available through its network's DNS resolution context. The situation calls for evidence that lookups through the VNet's configured DNS server return private endpoint addresses for the zone suffix.

That observation would primarily validate another control: remove a self-referential forwarding ruleset link or rule to prevent a resolver forwarding loop. Forwarding to an inbound endpoint from a ruleset linked to that same resolver VNet can cause a DNS loop. The situation calls for evidence that lookups through the VNet's configured DNS server return private endpoint addresses for the zone suffix.

NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. However, the option would implement combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth; the scenario instead requires correlate firewall decision logs with source and destination effective routes and return connectivity. The differentiating evidence is that a packet trace and log entry identify the failing layer and the corrected flow succeeds both directions.

Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. However, the option would implement configure a DNAT rule with the intended public destination, private target and matching security controls; the scenario instead requires correlate firewall decision logs with source and destination effective routes and return connectivity. The differentiating evidence is that a packet trace and log entry identify the failing layer and the corrected flow succeeds both directions.

Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. However, the option would implement create an Azure Firewall application rule scoped to the required FQDN and protocol; the scenario instead requires correlate firewall decision logs with source and destination effective routes and return connectivity. The differentiating evidence is that a packet trace and log entry identify the failing layer and the corrected flow succeeds both directions.

That observation would primarily validate another control: compare Network Watcher effective routes and effective security rules for the affected NIC. Routing and filtering are independent controls; both must support a successful end-to-end connection. The situation calls for evidence that the investigation reports the actual DNS target, path and application response and isolates the failed dependency.

That observation would primarily validate another control: use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends. Aggregated network views connect resource health and relevant network signals for operations analysis. The situation calls for evidence that the investigation reports the actual DNS target, path and application response and isolates the failed dependency.

That observation would primarily validate another control: enable supported VNet flow logs with the intended storage and analysis configuration. VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. The situation calls for evidence that the investigation reports the actual DNS target, path and application response and isolates the failed dependency.

Virtual WAN Standard supports centralized hub routing and expanded branch/VNet connectivity services. However, the option would implement deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections; the scenario instead requires correct Virtual WAN route table associations and propagation labels for the connected networks. The differentiating evidence is that route tables show the intended prefixes and application testing reaches the branch destination.

Virtual WAN supports specific managed NVA integrations and partner deployment requirements. However, the option would implement use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model; the scenario instead requires correct Virtual WAN route table associations and propagation labels for the connected networks. The differentiating evidence is that route tables show the intended prefixes and application testing reaches the branch destination.

Virtual WAN gateway components are service-specific; S2S VPN gateway does not terminate ExpressRoute. However, the option would implement provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits; the scenario instead requires correct Virtual WAN route table associations and propagation labels for the connected networks. The differentiating evidence is that route tables show the intended prefixes and application testing reaches the branch destination.

That observation would primarily validate another control: create the needed private endpoints and matching DNS zones for each required supported storage subresource. Private Link for multi-service resources may have different endpoint group IDs and DNS zones. The situation calls for evidence that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

That observation would primarily validate another control: review and configure supported private endpoint network policies and the associated subnet routes deliberately. Private endpoint policy support and traffic paths must be consistent with the desired inspection/segmentation design. The situation calls for evidence that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

That observation would primarily validate another control: use individual approved private endpoint connections and enforce data-plane identity authorization. DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. The situation calls for evidence that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

UDRs affect only subnets to which their route table is associated. However, the option would implement associate the intended route table with every subnet that must use that UDR policy; the scenario instead requires inspect the effective-route longest-prefix match and add the proper more-specific route where supported. The differentiating evidence is that an effective-route check selects the intended specific prefix and test packets reach the right target.

Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. However, the option would implement use Azure Virtual Network Manager connectivity configurations and appropriate network groups; the scenario instead requires inspect the effective-route longest-prefix match and add the proper more-specific route where supported. The differentiating evidence is that an effective-route check selects the intended specific prefix and test packets reach the right target.

Stateful firewalls need consistent bidirectional session visibility or supported asymmetric-flow handling. However, the option would implement validate symmetric request and return routes through the stateful inspection appliance; the scenario instead requires inspect the effective-route longest-prefix match and add the proper more-specific route where supported. The differentiating evidence is that an effective-route check selects the intended specific prefix and test packets reach the right target.