That observation would primarily validate another control: associate a supported static public IP resource with the correct VM network interface configuration. A standalone VM public IP attachment belongs to a NIC IP configuration and a static allocation preserves its address. The situation calls for evidence that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

That observation would primarily validate another control: use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources. A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. The situation calls for evidence that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

That observation would primarily validate another control: reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility. Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. The situation calls for evidence that gateway deployment succeeds and a test prefix is reachable through the expected gateway connection.

Virtual WAN supports user VPN gateways for individually authenticated client connectivity. However, the option would implement deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration; the scenario instead requires design Virtual WAN traffic security explicitly with compatible firewall and routing features. The differentiating evidence is that an approved risky connection triggers the configured firewall rule while permitted test traffic passes.

Different Virtual WAN gateway types have configurable scale units and supported limits. However, the option would implement choose the appropriate Virtual WAN hub gateway scale units and capacity parameters; the scenario instead requires design Virtual WAN traffic security explicitly with compatible firewall and routing features. The differentiating evidence is that an approved risky connection triggers the configured firewall rule while permitted test traffic passes.

Virtual hubs need relevant gateways to terminate the actual connection type. However, the option would implement deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings; the scenario instead requires design Virtual WAN traffic security explicitly with compatible firewall and routing features. The differentiating evidence is that an approved risky connection triggers the configured firewall rule while permitted test traffic passes.

That observation would primarily validate another control: deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes. Public Load Balancer distributes layer-4 flows across healthy backends without inspecting URL paths. The situation calls for evidence that a statistically meaningful set of test DNS answers reflects the configured relative weights.

That observation would primarily validate another control: configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules. High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. The situation calls for evidence that a statistically meaningful set of test DNS answers reflects the configured relative weights.

That observation would primarily validate another control: use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers. Cross-region Load Balancer extends supported layer-4 distribution across healthy regional frontends. The situation calls for evidence that a statistically meaningful set of test DNS answers reflects the configured relative weights.

That observation would primarily validate another control: publish only the eligible Private Link service target with appropriate access policy rather than VNet peering. Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. The situation calls for evidence that a request from the actual integrated service resolves the endpoint privately and completes the database query.

That observation would primarily validate another control: plan consistent private DNS zone links or resolver forwarding across the client VNets. Private DNS zone visibility follows VNet links and resolution architecture, not merely peering topology. The situation calls for evidence that a request from the actual integrated service resolves the endpoint privately and completes the database query.

That observation would primarily validate another control: use a Private Link service with explicit connection approval and supported provider NAT configuration. A provider Private Link service can expose eligible private load-balanced workloads to consumer subscriptions. The situation calls for evidence that a request from the actual integrated service resolves the endpoint privately and completes the database query.

ASGs identify groups of NICs for rule targets without hard-coding changing workload IPs. However, the option would implement create an application security group and reference it in supported NSG rules for member network interfaces; the scenario instead requires inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. The differentiating evidence is that the tool identifies the actual rule and the targeted test behaves correctly after remediation.

A missing application log can result from network filtering or an unavailable listener; both need evidence. However, the option would implement use Network Watcher connection testing and IP flow verify alongside service listener checks; the scenario instead requires inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. The differentiating evidence is that the tool identifies the actual rule and the targeted test behaves correctly after remediation.

Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. However, the option would implement store NSG configurations in versioned IaC and validate effective rules before and after deployment; the scenario instead requires inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. The differentiating evidence is that the tool identifies the actual rule and the targeted test behaves correctly after remediation.

Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. However, the option would implement use Azure Virtual Network Manager connectivity configurations and appropriate network groups; the scenario instead requires design an explicit routed transit path using an NVA or supported hub routing architecture. The differentiating evidence is that a probe between spokes follows the approved transit hop and reverse traffic returns over a valid path.

Direct VNet peering does not resolve overlapping address-space ambiguity. However, the option would implement renumber overlapping VNet address spaces before peering or design a supported translation boundary; the scenario instead requires design an explicit routed transit path using an NVA or supported hub routing architecture. The differentiating evidence is that a probe between spokes follows the approved transit hop and reverse traffic returns over a valid path.

A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. However, the option would implement review effective routes and keep the explicit appliance route when inspected forced tunneling is required; the scenario instead requires design an explicit routed transit path using an NVA or supported hub routing architecture. The differentiating evidence is that a probe between spokes follows the approved transit hop and reverse traffic returns over a valid path.

That observation would primarily validate another control: configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints. Active-active VPN gateway instances can provide redundant tunnel paths when peer devices support the design. The situation calls for evidence that the selected gateway instance scales successfully and its associated VPN remains healthy.

That observation would primarily validate another control: design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. Internet-bound branch traffic requires explicit default-route propagation and a compatible secured hub path. The situation calls for evidence that the selected gateway instance scales successfully and its associated VPN remains healthy.

That observation would primarily validate another control: check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes. Tunnel control-plane status and Azure data-plane next-hop selection are separate conditions. The situation calls for evidence that the selected gateway instance scales successfully and its associated VPN remains healthy.

WAF policy association and custom rule match conditions determine where application-layer controls apply. However, the option would implement scope and associate appropriate WAF security policies to supported domains or path patterns; the scenario instead requires associate a Front Door WAF policy with the intended endpoint domains through a security policy. The differentiating evidence is that a safe test request triggers the documented edge action and no origin request is observed for a blocked sample.

Targeted tuning preserves the broader managed rule set while addressing a justified false positive. However, the option would implement apply a narrowly scoped WAF exclusion or supported per-rule override instead of disabling all protection; the scenario instead requires associate a Front Door WAF policy with the intended endpoint domains through a security policy. The differentiating evidence is that a safe test request triggers the documented edge action and no origin request is observed for a blocked sample.

Geographic filtering requires explicit request-based policy and should not be confused with backend origin placement. However, the option would implement define WAF custom geographic match rules or supported edge access controls for the target domains; the scenario instead requires associate a Front Door WAF policy with the intended endpoint domains through a security policy. The differentiating evidence is that a safe test request triggers the documented edge action and no origin request is observed for a blocked sample.

DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. However, the option would implement use individual approved private endpoint connections and enforce data-plane identity authorization; the scenario instead requires link the correct service-specific private DNS zone to the client VNet and verify A-record resolution. The differentiating evidence is that the service FQDN resolves to the private endpoint IP and a client connects successfully.

Private DNS zone visibility follows VNet links and resolution architecture, not merely peering topology. However, the option would implement plan consistent private DNS zone links or resolver forwarding across the client VNets; the scenario instead requires link the correct service-specific private DNS zone to the client VNet and verify A-record resolution. The differentiating evidence is that the service FQDN resolves to the private endpoint IP and a client connects successfully.

Private endpoints map a supported PaaS service into a VNet through a private network interface. However, the option would implement create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration; the scenario instead requires link the correct service-specific private DNS zone to the client VNet and verify A-record resolution. The differentiating evidence is that the service FQDN resolves to the private endpoint IP and a client connects successfully.

Virtual WAN Standard supports centralized hub routing and expanded branch/VNet connectivity services. However, the option would implement deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections; the scenario instead requires use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. The differentiating evidence is that the partner connection lacks protected prefixes while authorized business network routes remain reachable.

Virtual WAN gateway components are service-specific; S2S VPN gateway does not terminate ExpressRoute. However, the option would implement provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits; the scenario instead requires use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. The differentiating evidence is that the partner connection lacks protected prefixes while authorized business network routes remain reachable.

Virtual hub route-table propagation determines which connection prefixes are visible to each subscriber. However, the option would implement configure route propagation from the branch connection into the spoke's associated route table; the scenario instead requires use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. The differentiating evidence is that the partner connection lacks protected prefixes while authorized business network routes remain reachable.

That observation would primarily validate another control: choose the service-supported delegated subnet and remove incompatible delegation or workload placements. Subnet delegation is scoped to supported service providers and imposes placement constraints. The situation calls for evidence that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

That observation would primarily validate another control: provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway. Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. The situation calls for evidence that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

That observation would primarily validate another control: create purpose-specific subnets in the VNet and apply matching network security and routing controls. VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. The situation calls for evidence that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.