That observation would primarily validate another control: place Front Door in front of appropriate regional origin gateways with correct host headers and probes. Front Door provides global entry and acceleration, while regional gateways retain local layer-7 capabilities. The situation calls for evidence that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

That observation would primarily validate another control: apply supported origin access restrictions using Front Door identification and approved security controls. Public origins need defenses against clients bypassing edge WAF and delivery rules. The situation calls for evidence that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

That observation would primarily validate another control: use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. The situation calls for evidence that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. However, the option would implement enable autoregistration for the appropriate VNet link to an Azure Private DNS zone; the scenario instead requires create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. The differentiating evidence is that a query to public recursive resolvers returns the delegated Azure DNS answer for the test hostname.

Existing workloads may retain DNS settings obtained before a VNet-level resolver change. However, the option would implement refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings; the scenario instead requires create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. The differentiating evidence is that a query to public recursive resolvers returns the delegated Azure DNS answer for the test hostname.

Private Link connectivity commonly depends on the appropriate privatelink DNS zone and VNet link. However, the option would implement create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs; the scenario instead requires create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. The differentiating evidence is that a query to public recursive resolvers returns the delegated Azure DNS answer for the test hostname.

That observation would primarily validate another control: inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. The situation calls for evidence that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

That observation would primarily validate another control: configure supported private endpoint network-policy settings and relevant NSG rules where enabled. Private endpoint NSG and UDR enforcement depends on subnet network policy configuration. The situation calls for evidence that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

That observation would primarily validate another control: use Azure Virtual Network Manager security admin configurations within supported scope. Security admin rules can centrally enforce network intent across managed VNet groups. The situation calls for evidence that iP flow verify shows the intended matching priority and a targeted connection behaves as designed.

Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. However, the option would implement deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies; the scenario instead requires use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. The differentiating evidence is that the partner connection lacks protected prefixes while authorized business network routes remain reachable.

Virtual WAN gateway components are service-specific; S2S VPN gateway does not terminate ExpressRoute. However, the option would implement provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits; the scenario instead requires use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. The differentiating evidence is that the partner connection lacks protected prefixes while authorized business network routes remain reachable.

Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. However, the option would implement design Virtual WAN traffic security explicitly with compatible firewall and routing features; the scenario instead requires use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. The differentiating evidence is that the partner connection lacks protected prefixes while authorized business network routes remain reachable.

Outbound client-initiated traffic and unsolicited inbound sessions are separate NSG directions. However, the option would implement configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules; the scenario instead requires store NSG configurations in versioned IaC and validate effective rules before and after deployment. The differentiating evidence is that a rollback restores the expected NSG action and an audit trail identifies the configuration change.

NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. However, the option would implement correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering; the scenario instead requires store NSG configurations in versioned IaC and validate effective rules before and after deployment. The differentiating evidence is that a rollback restores the expected NSG action and an audit trail identifies the configuration change.

Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. However, the option would implement create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route; the scenario instead requires store NSG configurations in versioned IaC and validate effective rules before and after deployment. The differentiating evidence is that a rollback restores the expected NSG action and an audit trail identifies the configuration change.

URL path maps select backend targets on HTTP path matches, with default behavior for other paths. However, the option would implement configure path-based routing rules and suitable default backend pool in Application Gateway; the scenario instead requires enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. The differentiating evidence is that gateway capacity increases within configured limits and response/error metrics remain within target thresholds.

Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. However, the option would implement add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing; the scenario instead requires enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. The differentiating evidence is that gateway capacity increases within configured limits and response/error metrics remain within target thresholds.

Layer-7 backend routing and TLS validation depend on the host and protocol settings. However, the option would implement align Application Gateway backend host-name and health-probe configuration with the origin virtual host; the scenario instead requires enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. The differentiating evidence is that gateway capacity increases within configured limits and response/error metrics remain within target thresholds.

Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. However, the option would implement configure hub gateway transit and enable use of remote gateways on the eligible spoke peering; the scenario instead requires associate the intended route table with every subnet that must use that UDR policy. The differentiating evidence is that test NICs in all selected subnets show the UDR while a deliberately excluded subnet retains its system routes.

Forced tunneling through an appliance requires an explicit default route from the workload subnet. However, the option would implement apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop; the scenario instead requires associate the intended route table with every subnet that must use that UDR policy. The differentiating evidence is that test NICs in all selected subnets show the UDR while a deliberately excluded subnet retains its system routes.

VNet peering is not intrinsically transitive; a route or gateway strategy is required for spoke-to-spoke transit. However, the option would implement design an explicit routed transit path using an NVA or supported hub routing architecture; the scenario instead requires associate the intended route table with every subnet that must use that UDR policy. The differentiating evidence is that test NICs in all selected subnets show the UDR while a deliberately excluded subnet retains its system routes.

Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. However, the option would implement add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace; the scenario instead requires create appropriate public-zone A records for IPv4 and MX records for mail routing. The differentiating evidence is that public DNS queries return the planned A address and the independent mail exchanger entries.

Inbound and outbound resolver endpoints use dedicated subnets that cannot host unrelated workloads. However, the option would implement create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints; the scenario instead requires create appropriate public-zone A records for IPv4 and MX records for mail routing. The differentiating evidence is that public DNS queries return the planned A address and the independent mail exchanger entries.

Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. However, the option would implement enable autoregistration for the appropriate VNet link to an Azure Private DNS zone; the scenario instead requires create appropriate public-zone A records for IPv4 and MX records for mail routing. The differentiating evidence is that public DNS queries return the planned A address and the independent mail exchanger entries.

VPN authentication alone does not install all required routes to remote interconnected networks. However, the option would implement review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes; the scenario instead requires configure P2S root certificate trust and issue valid client certificates from the approved CA. The differentiating evidence is that a valid test client establishes the VPN while a certificate from an untrusted issuer is denied.

Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. However, the option would implement assign a distinct nonoverlapping P2S client address pool and republish the client configuration; the scenario instead requires configure P2S root certificate trust and issue valid client certificates from the approved CA. The differentiating evidence is that a valid test client establishes the VPN while a certificate from an untrusted issuer is denied.

P2S gateway SKU limits and client tunnel health are distinct from account credential validity. However, the option would implement inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls; the scenario instead requires configure P2S root certificate trust and issue valid client certificates from the approved CA. The differentiating evidence is that a valid test client establishes the VPN while a certificate from an untrusted issuer is denied.

That observation would primarily validate another control: place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets. Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. The situation calls for evidence that the service integration deploys into the delegated subnet and private downstream connections succeed.

That observation would primarily validate another control: reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility. Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. The situation calls for evidence that the service integration deploys into the delegated subnet and private downstream connections succeed.

That observation would primarily validate another control: provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall. Azure Firewall uses a specific reserved subnet name and supported minimum capacity for deployment and scaling. The situation calls for evidence that the service integration deploys into the delegated subnet and private downstream connections succeed.

That observation would primarily validate another control: associate a supported static public IP resource with the correct VM network interface configuration. A standalone VM public IP attachment belongs to a NIC IP configuration and a static allocation preserves its address. The situation calls for evidence that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

That observation would primarily validate another control: use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources. A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. The situation calls for evidence that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

That observation would primarily validate another control: reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility. Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. The situation calls for evidence that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.