That observation would primarily validate another control: choose the service-supported delegated subnet and remove incompatible delegation or workload placements. Subnet delegation is scoped to supported service providers and imposes placement constraints. The situation calls for evidence that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

That observation would primarily validate another control: provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway. Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. The situation calls for evidence that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

That observation would primarily validate another control: create purpose-specific subnets in the VNet and apply matching network security and routing controls. VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. The situation calls for evidence that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

That observation would primarily validate another control: configure path-based routing rules and suitable default backend pool in Application Gateway. URL path maps select backend targets on HTTP path matches, with default behavior for other paths. The situation calls for evidence that requests with each hostname reach the intended backend while a mismatched host is rejected or handled per design.

That observation would primarily validate another control: move the gateway into a supported dedicated subnet with adequate addresses for expected scaling. Application Gateway has subnet placement and IP capacity requirements distinct from backend pools. The situation calls for evidence that requests with each hostname reach the intended backend while a mismatched host is rejected or handled per design.

That observation would primarily validate another control: align Application Gateway backend host-name and health-probe configuration with the origin virtual host. Layer-7 backend routing and TLS validation depend on the host and protocol settings. The situation calls for evidence that requests with each hostname reach the intended backend while a mismatched host is rejected or handled per design.

Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. However, the option would implement publish only the eligible Private Link service target with appropriate access policy rather than VNet peering; the scenario instead requires approve the intended private endpoint connection on the target resource before testing access. The differentiating evidence is that the connection status shows approved and the authorized client completes the expected service handshake.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires approve the intended private endpoint connection on the target resource before testing access. The differentiating evidence is that the connection status shows approved and the authorized client completes the expected service handshake.

Private Link for multi-service resources may have different endpoint group IDs and DNS zones. However, the option would implement create the needed private endpoints and matching DNS zones for each required supported storage subresource; the scenario instead requires approve the intended private endpoint connection on the target resource before testing access. The differentiating evidence is that the connection status shows approved and the authorized client completes the expected service handshake.

Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. However, the option would implement enable autoregistration for the appropriate VNet link to an Azure Private DNS zone; the scenario instead requires create appropriate public-zone A records for IPv4 and MX records for mail routing. The differentiating evidence is that public DNS queries return the planned A address and the independent mail exchanger entries.

The inbound endpoint accepts hybrid DNS queries and can resolve private zones linked to its VNet. However, the option would implement deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP; the scenario instead requires create appropriate public-zone A records for IPv4 and MX records for mail routing. The differentiating evidence is that public DNS queries return the planned A address and the independent mail exchanger entries.

Name resolution visibility is determined by private-zone linking and namespace selection. However, the option would implement separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links; the scenario instead requires create appropriate public-zone A records for IPv4 and MX records for mail routing. The differentiating evidence is that public DNS queries return the planned A address and the independent mail exchanger entries.

Private DNS zone visibility follows VNet links and resolution architecture, not merely peering topology. However, the option would implement plan consistent private DNS zone links or resolver forwarding across the client VNets; the scenario instead requires create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. The differentiating evidence is that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. However, the option would implement publish only the eligible Private Link service target with appropriate access policy rather than VNet peering; the scenario instead requires create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. The differentiating evidence is that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

Private Link consumer connections can be managed individually without deleting the underlying PaaS resource. However, the option would implement remove or reject only the obsolete private endpoint connection and clean up its DNS records; the scenario instead requires create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. The differentiating evidence is that an approved VNet client resolves the service to its private endpoint IP and connects with public access restricted.

Application Gateway provides regional layer-7 routing and TLS termination for HTTP services. However, the option would implement deploy Azure Application Gateway with HTTPS listener and path-based routing rules; the scenario instead requires configure appropriate multi-site listeners and host-based routing rules on Application Gateway. The differentiating evidence is that requests with each hostname reach the intended backend while a mismatched host is rejected or handled per design.

Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. However, the option would implement replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener; the scenario instead requires configure appropriate multi-site listeners and host-based routing rules on Application Gateway. The differentiating evidence is that requests with each hostname reach the intended backend while a mismatched host is rejected or handled per design.

Gateway backend health uses probe settings that must match the application's listener and host expectations. However, the option would implement configure a custom Application Gateway health probe with the correct host header, protocol and probe path; the scenario instead requires configure appropriate multi-site listeners and host-based routing rules on Application Gateway. The differentiating evidence is that requests with each hostname reach the intended backend while a mismatched host is rejected or handled per design.

That observation would primarily validate another control: use the supported Front Door purge cache operation for affected URL patterns. Front Door cache purging invalidates stale edge copies in supported scopes. The situation calls for evidence that a permitted benign request succeeds and an approved safe WAF test produces a matching edge policy action.

That observation would primarily validate another control: deploy Azure Front Door with appropriate origin groups and endpoint routes. Front Door is a globally distributed application delivery service that proxies and routes HTTP(S) traffic to healthy origins. The situation calls for evidence that a permitted benign request succeeds and an approved safe WAF test produces a matching edge policy action.

That observation would primarily validate another control: complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. The situation calls for evidence that a permitted benign request succeeds and an approved safe WAF test produces a matching edge policy action.

That observation would primarily validate another control: refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings. Existing workloads may retain DNS settings obtained before a VNet-level resolver change. The situation calls for evidence that a client in a linked VNet resolves the office-only record through the approved target DNS servers.

That observation would primarily validate another control: reduce record TTL before a planned migration and validate propagation and client cache expiry. DNS caching can delay a record change independently of network route availability. The situation calls for evidence that a client in a linked VNet resolves the office-only record through the approved target DNS servers.

That observation would primarily validate another control: apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. DNS-layer policy can block known malicious domains without treating an IP firewall allow rule as DNS security. The situation calls for evidence that a client in a linked VNet resolves the office-only record through the approved target DNS servers.

Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. However, the option would implement choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed; the scenario instead requires align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN. The differentiating evidence is that iKE negotiation succeeds and protected test packets traverse the established IPsec security association.

Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. However, the option would implement assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply; the scenario instead requires align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN. The differentiating evidence is that iKE negotiation succeeds and protected test packets traverse the established IPsec security association.

Gateway transit makes the shared hub VPN connection available to eligible peered spokes. However, the option would implement enable hub gateway transit and compatible remote-gateway peering usage on the spoke; the scenario instead requires align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN. The differentiating evidence is that iKE negotiation succeeds and protected test packets traverse the established IPsec security association.

That observation would primarily validate another control: match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters. Private peering is a BGP arrangement and cannot establish with inconsistent peer identifiers or IP addressing. The situation calls for evidence that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

That observation would primarily validate another control: design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections. Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. The situation calls for evidence that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

That observation would primarily validate another control: select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. The situation calls for evidence that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

That observation would primarily validate another control: choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. P2S tunnel protocol support varies by gateway settings and VPN client platform. The situation calls for evidence that gateway metrics show adequate capacity and the test client remains connected under a representative load.

That observation would primarily validate another control: assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. The situation calls for evidence that gateway metrics show adequate capacity and the test client remains connected under a representative load.

That observation would primarily validate another control: revoke or deny the specific P2S client certificate by supported gateway configuration and policy. Certificate trust must be able to exclude compromised or retired client certificates. The situation calls for evidence that gateway metrics show adequate capacity and the test client remains connected under a representative load.