Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. However, the option would implement place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets; the scenario instead requires provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall. The differentiating evidence is that the managed firewall instance provisions successfully in the reserved subnet and receives its intended private IP.

IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. However, the option would implement add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends; the scenario instead requires provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall. The differentiating evidence is that the managed firewall instance provisions successfully in the reserved subnet and receives its intended private IP.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall. The differentiating evidence is that the managed firewall instance provisions successfully in the reserved subnet and receives its intended private IP.

Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. However, the option would implement reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility; the scenario instead requires create purpose-specific subnets in the VNet and apply matching network security and routing controls. The differentiating evidence is that test packets follow the correct subnet route and the intended allow or deny decision is recorded.

IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. However, the option would implement add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends; the scenario instead requires create purpose-specific subnets in the VNet and apply matching network security and routing controls. The differentiating evidence is that test packets follow the correct subnet route and the intended allow or deny decision is recorded.

A standalone VM public IP attachment belongs to a NIC IP configuration and a static allocation preserves its address. However, the option would implement associate a supported static public IP resource with the correct VM network interface configuration; the scenario instead requires create purpose-specific subnets in the VNet and apply matching network security and routing controls. The differentiating evidence is that test packets follow the correct subnet route and the intended allow or deny decision is recorded.

That observation would primarily validate another control: associate a supported static public IP resource with the correct VM network interface configuration. A standalone VM public IP attachment belongs to a NIC IP configuration and a static allocation preserves its address. The situation calls for evidence that the allocated public IP resources fall inside the reserved prefix and attach to intended front-end resources.

That observation would primarily validate another control: reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility. Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. The situation calls for evidence that the allocated public IP resources fall inside the reserved prefix and attach to intended front-end resources.

That observation would primarily validate another control: create purpose-specific subnets in the VNet and apply matching network security and routing controls. VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. The situation calls for evidence that the allocated public IP resources fall inside the reserved prefix and attach to intended front-end resources.

That observation would primarily validate another control: define address and segmentation standards in IaC with governance checks before production deployment. Reproducible network definitions and validation catch overlapping or noncompliant ranges before live peering. The situation calls for evidence that both endpoints receive private addresses and approved clients connect using the corresponding endpoint records.

That observation would primarily validate another control: create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services. Gateway, Bastion, Firewall, private endpoint and application delivery components require space and specific subnet planning. The situation calls for evidence that both endpoints receive private addresses and approved clients connect using the corresponding endpoint records.

That observation would primarily validate another control: plan address-space updates with peering synchronization and dependency validation before routing cutover. Connected peers and gateways must recognize updated prefixes and traffic cannot rely on stale addressing during migration. The situation calls for evidence that both endpoints receive private addresses and approved clients connect using the corresponding endpoint records.

That observation would primarily validate another control: deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters. NSGs enforce network transport rules and do not parse application attack payloads. The situation calls for evidence that the frontend shows the active policy association and a representative managed-rule test is logged.

That observation would primarily validate another control: limit WAF exclusions to the smallest required match variable, field or rule. Broad WAF exclusions create avoidable blind spots while a targeted exception can preserve other detection coverage. The situation calls for evidence that the frontend shows the active policy association and a representative managed-rule test is logged.

That observation would primarily validate another control: define WAF custom geographic match rules or supported edge access controls for the target domains. Geographic filtering requires explicit request-based policy and should not be confused with backend origin placement. The situation calls for evidence that the frontend shows the active policy association and a representative managed-rule test is logged.

That observation would primarily validate another control: configure path-based routing rules and suitable default backend pool in Application Gateway. URL path maps select backend targets on HTTP path matches, with default behavior for other paths. The situation calls for evidence that gateway deployment and scale-out succeed while backend instances remain in approved separate subnets.

That observation would primarily validate another control: configure an Application Gateway rewrite rule set matching the required request or response conditions. Rewrite rules modify supported HTTP header and URL aspects without requiring changes in every backend service. The situation calls for evidence that gateway deployment and scale-out succeed while backend instances remain in approved separate subnets.

That observation would primarily validate another control: attach a supported Application Gateway WAF policy in the intended enforcement mode. Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. The situation calls for evidence that gateway deployment and scale-out succeed while backend instances remain in approved separate subnets.

Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. However, the option would implement use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing; the scenario instead requires use Gateway Load Balancer and a supported transparent NVA service-chain configuration. The differentiating evidence is that an approved connection traverses the appliance and appears in inspection logs before reaching the backend.

Performance routing maps DNS clients to suitable regional endpoints using the Traffic Manager performance model. However, the option would implement use Traffic Manager Performance routing with enabled healthy endpoints; the scenario instead requires use Gateway Load Balancer and a supported transparent NVA service-chain configuration. The differentiating evidence is that an approved connection traverses the appliance and appears in inspection logs before reaching the backend.

Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. However, the option would implement configure suitable load-balancing rules including HA ports where the chosen internal design supports them; the scenario instead requires use Gateway Load Balancer and a supported transparent NVA service-chain configuration. The differentiating evidence is that an approved connection traverses the appliance and appears in inspection logs before reaching the backend.

That observation would primarily validate another control: inspect the effective-route longest-prefix match and add the proper more-specific route where supported. Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. The situation calls for evidence that packet captures on both sides show request and response traversing the expected inspection point.

That observation would primarily validate another control: deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. Centralized change definitions make route and topology deviations detectable before deployment. The situation calls for evidence that packet captures on both sides show request and response traversing the expected inspection point.

That observation would primarily validate another control: use Azure Route Server with a supported BGP peer to exchange routes dynamically. Route Server exchanges BGP information with compatible appliances and Azure networking instead of relying on static edits. The situation calls for evidence that packet captures on both sides show request and response traversing the expected inspection point.

That observation would primarily validate another control: review effective routes and keep the explicit appliance route when inspected forced tunneling is required. A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. The situation calls for evidence that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

That observation would primarily validate another control: inspect the effective-route longest-prefix match and add the proper more-specific route where supported. Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. The situation calls for evidence that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

That observation would primarily validate another control: associate the intended route table with every subnet that must use that UDR policy. UDRs affect only subnets to which their route table is associated. The situation calls for evidence that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

That observation would primarily validate another control: correct Virtual WAN route table associations and propagation labels for the connected networks. Virtual hub routing depends on the association and propagation configuration of each connection. The situation calls for evidence that an authorized branch-to-spoke and hub-to-hub test follows the expected managed routing path.

That observation would primarily validate another control: provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits. Virtual WAN gateway components are service-specific; S2S VPN gateway does not terminate ExpressRoute. The situation calls for evidence that an authorized branch-to-spoke and hub-to-hub test follows the expected managed routing path.

That observation would primarily validate another control: choose the appropriate Virtual WAN hub gateway scale units and capacity parameters. Different Virtual WAN gateway types have configurable scale units and supported limits. The situation calls for evidence that an authorized branch-to-spoke and hub-to-hub test follows the expected managed routing path.

That observation would primarily validate another control: respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. The situation calls for evidence that test NICs in all selected subnets show the UDR while a deliberately excluded subnet retains its system routes.

That observation would primarily validate another control: place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs. Subnet NAT Gateway supplies outbound-only address translation without creating VM public listeners. The situation calls for evidence that test NICs in all selected subnets show the UDR while a deliberately excluded subnet retains its system routes.

That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that test NICs in all selected subnets show the UDR while a deliberately excluded subnet retains its system routes.