That observation would primarily validate another control: route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS. Private endpoints can serve on-premises clients when DNS and private routing to the VNet are established. The situation calls for evidence that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

That observation would primarily validate another control: remove or reject only the obsolete private endpoint connection and clean up its DNS records. Private Link consumer connections can be managed individually without deleting the underlying PaaS resource. The situation calls for evidence that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

That observation would primarily validate another control: require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. Connection approval separates consumer endpoint provisioning from provider authorization. The situation calls for evidence that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

Load balancing applies only to members registered in its backend pool and passing health checks. However, the option would implement register eligible NIC IP configurations or supported resources in the load balancer backend pool; the scenario instead requires configure Traffic Manager Weighted routing across the regional endpoints. The differentiating evidence is that a statistically meaningful set of test DNS answers reflects the configured relative weights.

Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. However, the option would implement configure Azure Traffic Manager with the correct routing method and endpoint health checks; the scenario instead requires configure Traffic Manager Weighted routing across the regional endpoints. The differentiating evidence is that a statistically meaningful set of test DNS answers reflects the configured relative weights.

Probe-driven backend health prevents new flows from being distributed to failing endpoints. However, the option would implement configure appropriate Load Balancer probe and rollout health gating for backend readiness; the scenario instead requires configure Traffic Manager Weighted routing across the regional endpoints. The differentiating evidence is that a statistically meaningful set of test DNS answers reflects the configured relative weights.

That observation would primarily validate another control: deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. The situation calls for evidence that the new prefix is visible in learned or configured routes and a specific application connection succeeds.

That observation would primarily validate another control: update the local network gateway resource with the remote VPN device public IP and correct prefixes. Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. The situation calls for evidence that the new prefix is visible in learned or configured routes and a specific application connection succeeds.

That observation would primarily validate another control: select a supported VPN gateway SKU meeting tunnel counts, throughput, BGP and resiliency requirements. Gateway SKU capacity and feature support determine whether a hybrid design can meet operational needs. The situation calls for evidence that the new prefix is visible in learned or configured routes and a specific application connection succeeds.

Security admin rules can centrally enforce network intent across managed VNet groups. However, the option would implement use Azure Virtual Network Manager security admin configurations within supported scope; the scenario instead requires create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. The differentiating evidence is that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

Azure service tags abstract changing Azure service address ranges in network security rules. However, the option would implement use the appropriate Azure service tag for supported NSG destination restrictions; the scenario instead requires create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. The differentiating evidence is that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

Priority and network scope determine whether an explicit source-block rule matches before broad allows. However, the option would implement create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points; the scenario instead requires create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route. The differentiating evidence is that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

Inbound Private Resolver resolves private zones available through its network's DNS resolution context. However, the option would implement link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path; the scenario instead requires link the intended spoke VNet to the appropriate DNS forwarding ruleset. The differentiating evidence is that queries from the newly linked spoke reach the rule target and resolve a test corporate hostname.

Inbound and outbound resolver endpoints use dedicated subnets that cannot host unrelated workloads. However, the option would implement create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints; the scenario instead requires link the intended spoke VNet to the appropriate DNS forwarding ruleset. The differentiating evidence is that queries from the newly linked spoke reach the rule target and resolve a test corporate hostname.

Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. However, the option would implement create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers; the scenario instead requires link the intended spoke VNet to the appropriate DNS forwarding ruleset. The differentiating evidence is that queries from the newly linked spoke reach the rule target and resolve a test corporate hostname.

That observation would primarily validate another control: set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection. Time-series health signals and actionable alert thresholds provide earlier detection than manual portal checks. The situation calls for evidence that the intended destination prefix and matching NSG allow action are visible before the application probe passes.

That observation would primarily validate another control: inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. Backend availability depends on probe reachability and network/security rules, not simply process existence. The situation calls for evidence that the intended destination prefix and matching NSG allow action are visible before the application probe passes.

That observation would primarily validate another control: review Defender for Cloud Secure Score security recommendations for network resources. Secure Score recommendations expose actionable posture findings to prioritize weak network configurations. The situation calls for evidence that the intended destination prefix and matching NSG allow action are visible before the application probe passes.

Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. However, the option would implement store NSG configurations in versioned IaC and validate effective rules before and after deployment; the scenario instead requires associate the NSG with the actual target subnet or network interface and validate effective policy. The differentiating evidence is that the target NIC shows expected effective rules and an authorized allow/deny test confirms enforcement.

Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. However, the option would implement create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route; the scenario instead requires associate the NSG with the actual target subnet or network interface and validate effective policy. The differentiating evidence is that the target NIC shows expected effective rules and an authorized allow/deny test confirms enforcement.

Private endpoint NSG and UDR enforcement depends on subnet network policy configuration. However, the option would implement configure supported private endpoint network-policy settings and relevant NSG rules where enabled; the scenario instead requires associate the NSG with the actual target subnet or network interface and validate effective policy. The differentiating evidence is that the target NIC shows expected effective rules and an authorized allow/deny test confirms enforcement.

An allow rule alone cannot establish name resolution, correct next hop and application endpoint identity. However, the option would implement collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes; the scenario instead requires set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection. The differentiating evidence is that a safe degraded-link test or monitored incident triggers the expected alert with affected resource context.

Backend availability depends on probe reachability and network/security rules, not simply process existence. However, the option would implement inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing; the scenario instead requires set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection. The differentiating evidence is that a safe degraded-link test or monitored incident triggers the expected alert with affected resource context.

VPN disconnect and gateway events require historical telemetry, not only current status views. However, the option would implement collect virtual network gateway diagnostic logs and metrics into centralized monitoring; the scenario instead requires set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection. The differentiating evidence is that a safe degraded-link test or monitored incident triggers the expected alert with affected resource context.

That observation would primarily validate another control: enable ExpressRoute FastPath on compatible circuits, gateways and network resources. FastPath can improve the data path for supported ExpressRoute configurations by bypassing the gateway dataplane. The situation calls for evidence that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

That observation would primarily validate another control: select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. The situation calls for evidence that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

That observation would primarily validate another control: design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections. Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. The situation calls for evidence that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

That observation would primarily validate another control: use Gateway Load Balancer and a supported transparent NVA service-chain configuration. Gateway Load Balancer integrates compatible NVAs into traffic flow without application-layer URL routing. The situation calls for evidence that queries from separated test locations resolve to the expected healthy regional endpoint under the policy.

That observation would primarily validate another control: configure suitable load-balancing rules including HA ports where the chosen internal design supports them. Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. The situation calls for evidence that queries from separated test locations resolve to the expected healthy regional endpoint under the policy.

That observation would primarily validate another control: configure an eligible health probe and backend listener that match the service port and NSG rules. Load Balancer health probes decide which backends are eligible for new flows. The situation calls for evidence that queries from separated test locations resolve to the expected healthy regional endpoint under the policy.

That observation would primarily validate another control: enable an appropriate virtual network service endpoint and allow the subnet in the service firewall. Service endpoints extend VNet identity to supported Azure services while service traffic uses the service's public endpoint. The situation calls for evidence that the branch resolves and connects through a private endpoint or its own explicitly allowed service network path.

That observation would primarily validate another control: apply supported service endpoint policies with the authorized storage resource definitions. Service endpoint policies can narrow egress to supported Azure service resources rather than all accounts. The situation calls for evidence that the branch resolves and connects through a private endpoint or its own explicitly allowed service network path.

That observation would primarily validate another control: verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately. Moving to Private Link requires validating both name resolution and authorization before retiring former service access. The situation calls for evidence that the branch resolves and connects through a private endpoint or its own explicitly allowed service network path.