UDRs affect only subnets to which their route table is associated. However, the option would implement associate the intended route table with every subnet that must use that UDR policy; the scenario instead requires inspect the effective-route longest-prefix match and add the proper more-specific route where supported. The differentiating evidence is that an effective-route check selects the intended specific prefix and test packets reach the right target.

Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. However, the option would implement use Azure Virtual Network Manager connectivity configurations and appropriate network groups; the scenario instead requires inspect the effective-route longest-prefix match and add the proper more-specific route where supported. The differentiating evidence is that an effective-route check selects the intended specific prefix and test packets reach the right target.

Stateful firewalls need consistent bidirectional session visibility or supported asymmetric-flow handling. However, the option would implement validate symmetric request and return routes through the stateful inspection appliance; the scenario instead requires inspect the effective-route longest-prefix match and add the proper more-specific route where supported. The differentiating evidence is that an effective-route check selects the intended specific prefix and test packets reach the right target.

That observation would primarily validate another control: validate DNS resolution separately from IP routing and provide an approved private network path. Correct name resolution does not create connectivity; routing, firewall and endpoint access still matter. The situation calls for evidence that queries from the newly linked spoke reach the rule target and resolve a test corporate hostname.

That observation would primarily validate another control: deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP. The inbound endpoint accepts hybrid DNS queries and can resolve private zones linked to its VNet. The situation calls for evidence that queries from the newly linked spoke reach the rule target and resolve a test corporate hostname.

That observation would primarily validate another control: add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace. Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. The situation calls for evidence that queries from the newly linked spoke reach the rule target and resolve a test corporate hostname.

Managed service and FQDN tags reduce brittle static destination-IP maintenance for supported services. However, the option would implement use supported Azure Firewall FQDN tags or service-aware policy features where applicable; the scenario instead requires replace blanket allows with least-privilege application and network rule collections. The differentiating evidence is that authorized dependencies remain functional while representative prohibited destinations are denied.

Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. However, the option would implement send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination; the scenario instead requires replace blanket allows with least-privilege application and network rule collections. The differentiating evidence is that authorized dependencies remain functional while representative prohibited destinations are denied.

Azure Firewall cannot inspect flows that routing directs around its data path. However, the option would implement associate the required UDR and validate effective routes across every protected workload subnet; the scenario instead requires replace blanket allows with least-privilege application and network rule collections. The differentiating evidence is that authorized dependencies remain functional while representative prohibited destinations are denied.

Broad WAF exclusions create avoidable blind spots while a targeted exception can preserve other detection coverage. However, the option would implement limit WAF exclusions to the smallest required match variable, field or rule; the scenario instead requires start the WAF in detection mode, review matched rules and then enable prevention after tuning. The differentiating evidence is that approved test requests produce WAF logs in detection and are appropriately blocked in prevention after tuning.

Targeted tuning preserves the broader managed rule set while addressing a justified false positive. However, the option would implement apply a narrowly scoped WAF exclusion or supported per-rule override instead of disabling all protection; the scenario instead requires start the WAF in detection mode, review matched rules and then enable prevention after tuning. The differentiating evidence is that approved test requests produce WAF logs in detection and are appropriately blocked in prevention after tuning.

Geographic filtering requires explicit request-based policy and should not be confused with backend origin placement. However, the option would implement define WAF custom geographic match rules or supported edge access controls for the target domains; the scenario instead requires start the WAF in detection mode, review matched rules and then enable prevention after tuning. The differentiating evidence is that approved test requests produce WAF logs in detection and are appropriately blocked in prevention after tuning.

That observation would primarily validate another control: use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. The situation calls for evidence that a controlled request receives the required destination or reaches the rewritten origin path.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that a controlled request receives the required destination or reaches the rewritten origin path.

That observation would primarily validate another control: deploy Azure Front Door with appropriate origin groups and endpoint routes. Front Door is a globally distributed application delivery service that proxies and routes HTTP(S) traffic to healthy origins. The situation calls for evidence that a controlled request receives the required destination or reaches the rewritten origin path.

That observation would primarily validate another control: update NSG source or ASG membership for the new workload placement after validating its identity. IP-prefix and application security group membership determine which NSG rules match relocated workloads. The situation calls for evidence that a rollback restores the expected NSG action and an audit trail identifies the configuration change.

That observation would primarily validate another control: apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. NSGs filter packet tuples at subnet or NIC scope and can restrict access by source, destination, port and protocol. The situation calls for evidence that a rollback restores the expected NSG action and an audit trail identifies the configuration change.

That observation would primarily validate another control: create an application security group and reference it in supported NSG rules for member network interfaces. ASGs identify groups of NICs for rule targets without hard-coding changing workload IPs. The situation calls for evidence that a rollback restores the expected NSG action and an audit trail identifies the configuration change.

Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. However, the option would implement update the local network gateway resource with the remote VPN device public IP and correct prefixes; the scenario instead requires update local network gateway address spaces or validated BGP advertisements for the missing prefix. The differentiating evidence is that the new prefix is visible in learned or configured routes and a specific application connection succeeds.

IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. However, the option would implement align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN; the scenario instead requires update local network gateway address spaces or validated BGP advertisements for the missing prefix. The differentiating evidence is that the new prefix is visible in learned or configured routes and a specific application connection succeeds.

Identical local and remote prefixes make destination routing ambiguous across a site-to-site tunnel. However, the option would implement resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S; the scenario instead requires update local network gateway address spaces or validated BGP advertisements for the missing prefix. The differentiating evidence is that the new prefix is visible in learned or configured routes and a specific application connection succeeds.

That observation would primarily validate another control: design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections. Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. The situation calls for evidence that both sides learn the expected prefixes and bidirectional TCP testing succeeds.

That observation would primarily validate another control: provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. ExpressRoute provides private connectivity through a provider path, subject to service and circuit design. The situation calls for evidence that both sides learn the expected prefixes and bidirectional TCP testing succeeds.

That observation would primarily validate another control: choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning. Cloud exchange, point-to-point and other provider models have different operational and physical requirements. The situation calls for evidence that both sides learn the expected prefixes and bidirectional TCP testing succeeds.

Cloud exchange, point-to-point and other provider models have different operational and physical requirements. However, the option would implement choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning; the scenario instead requires use ExpressRoute Global Reach between eligible circuits and confirm support across their locations. The differentiating evidence is that a branch-to-branch route and packet trace traverse the intended Global Reach path.

ExpressRoute Direct offers dedicated port pairs for creating supported ExpressRoute circuits at high scale. However, the option would implement evaluate ExpressRoute Direct and its dedicated port and peering-location requirements; the scenario instead requires use ExpressRoute Global Reach between eligible circuits and confirm support across their locations. The differentiating evidence is that a branch-to-branch route and packet trace traverse the intended Global Reach path.

Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. However, the option would implement configure Microsoft peering only for eligible services and with the required prefix authorization and route filters; the scenario instead requires use ExpressRoute Global Reach between eligible circuits and confirm support across their locations. The differentiating evidence is that a branch-to-branch route and packet trace traverse the intended Global Reach path.

That observation would primarily validate another control: configure Front Door origin-group health probes and suitable priority or weight settings. Front Door origin selection depends on health probes and configured origin priority or weight. The situation calls for evidence that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

That observation would primarily validate another control: use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. The situation calls for evidence that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

That observation would primarily validate another control: configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content. Front Door edge caching improves static content delivery only when caching policies respect dynamic or private data. The situation calls for evidence that clients in separate regions use the edge endpoint and receive successful responses from intended healthy origins.

That observation would primarily validate another control: route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS. Private endpoints can serve on-premises clients when DNS and private routing to the VNet are established. The situation calls for evidence that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

That observation would primarily validate another control: remove or reject only the obsolete private endpoint connection and clean up its DNS records. Private Link consumer connections can be managed individually without deleting the underlying PaaS resource. The situation calls for evidence that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

That observation would primarily validate another control: require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. Connection approval separates consumer endpoint provisioning from provider authorization. The situation calls for evidence that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.