That observation would primarily validate another control: respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. The situation calls for evidence that test NICs in all selected subnets show the UDR while a deliberately excluded subnet retains its system routes.

That observation would primarily validate another control: place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs. Subnet NAT Gateway supplies outbound-only address translation without creating VM public listeners. The situation calls for evidence that test NICs in all selected subnets show the UDR while a deliberately excluded subnet retains its system routes.

That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that test NICs in all selected subnets show the UDR while a deliberately excluded subnet retains its system routes.

That observation would primarily validate another control: associate the required UDR and validate effective routes across every protected workload subnet. Azure Firewall cannot inspect flows that routing directs around its data path. The situation calls for evidence that a packet trace and log entry identify the failing layer and the corrected flow succeeds both directions.

That observation would primarily validate another control: configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination. Network rules are appropriate for transport and IP-address traffic that is not evaluated as HTTP hostnames. The situation calls for evidence that a packet trace and log entry identify the failing layer and the corrected flow succeeds both directions.

That observation would primarily validate another control: choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost. Basic, Standard and Premium tiers have different security capabilities and capacity. The situation calls for evidence that a packet trace and log entry identify the failing layer and the corrected flow succeeds both directions.

Front Door cache purging invalidates stale edge copies in supported scopes. However, the option would implement use the supported Front Door purge cache operation for affected URL patterns; the scenario instead requires configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content. The differentiating evidence is that repeated public asset requests show cache hits while authenticated account responses are not cached.

Front Door origin selection depends on health probes and configured origin priority or weight. However, the option would implement configure Front Door origin-group health probes and suitable priority or weight settings; the scenario instead requires configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content. The differentiating evidence is that repeated public asset requests show cache hits while authenticated account responses are not cached.

Public origins need defenses against clients bypassing edge WAF and delivery rules. However, the option would implement apply supported origin access restrictions using Front Door identification and approved security controls; the scenario instead requires configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content. The differentiating evidence is that repeated public asset requests show cache hits while authenticated account responses are not cached.

A rule allow is not sufficient when a request or response never passes the expected firewall path. However, the option would implement correlate firewall decision logs with source and destination effective routes and return connectivity; the scenario instead requires use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. The differentiating evidence is that both intended firewalls report the applied policy version and enforce the same representative test rule.

Advanced IDPS and TLS inspection are Premium capabilities and require certificate and policy planning. However, the option would implement select Azure Firewall Premium and configure supported TLS inspection and IDPS settings; the scenario instead requires use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. The differentiating evidence is that both intended firewalls report the applied policy version and enforce the same representative test rule.

Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. However, the option would implement deploy Azure Firewall into a supported hub and route workload egress through its private IP; the scenario instead requires use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. The differentiating evidence is that both intended firewalls report the applied policy version and enforce the same representative test rule.

That observation would primarily validate another control: choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. P2S tunnel protocol support varies by gateway settings and VPN client platform. The situation calls for evidence that an authorized remote device connects and reaches an approved private Azure subnet.

That observation would primarily validate another control: configure P2S root certificate trust and issue valid client certificates from the approved CA. Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. The situation calls for evidence that an authorized remote device connects and reaches an approved private Azure subnet.

That observation would primarily validate another control: configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets. RADIUS authentication depends on an accessible server and consistent protocol/authentication configuration. The situation calls for evidence that an authorized remote device connects and reaches an approved private Azure subnet.

Direct VNet peering does not resolve overlapping address-space ambiguity. However, the option would implement renumber overlapping VNet address spaces before peering or design a supported translation boundary; the scenario instead requires use Azure Virtual Network Manager connectivity configurations and appropriate network groups. The differentiating evidence is that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

UDRs affect only subnets to which their route table is associated. However, the option would implement associate the intended route table with every subnet that must use that UDR policy; the scenario instead requires use Azure Virtual Network Manager connectivity configurations and appropriate network groups. The differentiating evidence is that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

Traffic forwarded by an NVA requires compatible peering settings as well as layer-3 routing. However, the option would implement enable appropriate forwarded traffic settings on the relevant peering connections and retain correct return routes; the scenario instead requires use Azure Virtual Network Manager connectivity configurations and appropriate network groups. The differentiating evidence is that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

That observation would primarily validate another control: place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs. Subnet NAT Gateway supplies outbound-only address translation without creating VM public listeners. The situation calls for evidence that a drift check identifies an unauthorized default route and an approved template restores the intended path.

That observation would primarily validate another control: define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements. Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. The situation calls for evidence that a drift check identifies an unauthorized default route and an approved template restores the intended path.

That observation would primarily validate another control: inspect the effective-route longest-prefix match and add the proper more-specific route where supported. Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. The situation calls for evidence that a drift check identifies an unauthorized default route and an approved template restores the intended path.

That observation would primarily validate another control: collect virtual network gateway diagnostic logs and metrics into centralized monitoring. VPN disconnect and gateway events require historical telemetry, not only current status views. The situation calls for evidence that the query returns the expected exposed resources and excludes remediated or out-of-scope assets.

That observation would primarily validate another control: enable supported VNet flow logs with the intended storage and analysis configuration. VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. The situation calls for evidence that the query returns the expected exposed resources and excludes remediated or out-of-scope assets.

That observation would primarily validate another control: use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes. Connection troubleshoot evaluates the actual source-to-destination path rather than guessing from VM health status. The situation calls for evidence that the query returns the expected exposed resources and excludes remediated or out-of-scope assets.

That observation would primarily validate another control: configure path-based routing rules and suitable default backend pool in Application Gateway. URL path maps select backend targets on HTTP path matches, with default behavior for other paths. The situation calls for evidence that gateway deployment and scale-out succeed while backend instances remain in approved separate subnets.

That observation would primarily validate another control: attach a supported Application Gateway WAF policy in the intended enforcement mode. Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. The situation calls for evidence that gateway deployment and scale-out succeed while backend instances remain in approved separate subnets.

That observation would primarily validate another control: add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. The situation calls for evidence that gateway deployment and scale-out succeed while backend instances remain in approved separate subnets.

A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. However, the option would implement update local network gateway address spaces or validated BGP advertisements for the missing prefix; the scenario instead requires enable hub gateway transit and compatible remote-gateway peering usage on the spoke. The differentiating evidence is that branch clients reach the spoke prefix and the spoke effective route uses the hub's remote gateway.

Tunnel control-plane status and Azure data-plane next-hop selection are separate conditions. However, the option would implement check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes; the scenario instead requires enable hub gateway transit and compatible remote-gateway peering usage on the spoke. The differentiating evidence is that branch clients reach the spoke prefix and the spoke effective route uses the hub's remote gateway.

Gateway SKU capacity and feature support determine whether a hybrid design can meet operational needs. However, the option would implement select a supported VPN gateway SKU meeting tunnel counts, throughput, BGP and resiliency requirements; the scenario instead requires enable hub gateway transit and compatible remote-gateway peering usage on the spoke. The differentiating evidence is that branch clients reach the spoke prefix and the spoke effective route uses the hub's remote gateway.

Two WAF enforcement points can both inspect requests; policy coordination reduces conflicting false positives. However, the option would implement define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers; the scenario instead requires change the tuned WAF policy to prevention mode and confirm the intended managed rule action. The differentiating evidence is that the safe test produces the expected block status and origin logs show no delivered malicious request.

Managed rule set versions can change match behavior and should be tested against legitimate traffic. However, the option would implement review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence; the scenario instead requires change the tuned WAF policy to prevention mode and confirm the intended managed rule action. The differentiating evidence is that the safe test produces the expected block status and origin logs show no delivered malicious request.

Front Door WAF applies application-layer filtering at the Microsoft edge for protected routes. However, the option would implement associate a Front Door WAF policy with the intended endpoint domains through a security policy; the scenario instead requires change the tuned WAF policy to prevention mode and confirm the intended managed rule action. The differentiating evidence is that the safe test produces the expected block status and origin logs show no delivered malicious request.