That observation would primarily validate another control: choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. P2S tunnel protocol support varies by gateway settings and VPN client platform. The situation calls for evidence that gateway metrics show adequate capacity and the test client remains connected under a representative load.

That observation would primarily validate another control: assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. The situation calls for evidence that gateway metrics show adequate capacity and the test client remains connected under a representative load.

That observation would primarily validate another control: revoke or deny the specific P2S client certificate by supported gateway configuration and policy. Certificate trust must be able to exclude compromised or retired client certificates. The situation calls for evidence that gateway metrics show adequate capacity and the test client remains connected under a representative load.

That observation would primarily validate another control: restrict or disable the PaaS resource's public network access separately from creating its private endpoint. Private endpoints do not necessarily disable a service's existing public network endpoint automatically. The situation calls for evidence that the retired consumer route no longer works and active approved consumers remain connected.

That observation would primarily validate another control: use individual approved private endpoint connections and enforce data-plane identity authorization. DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. The situation calls for evidence that the retired consumer route no longer works and active approved consumers remain connected.

That observation would primarily validate another control: publish only the eligible Private Link service target with appropriate access policy rather than VNet peering. Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. The situation calls for evidence that the retired consumer route no longer works and active approved consumers remain connected.

That observation would primarily validate another control: allocate a Public IP Prefix and create supported public IP resources from that prefix. Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. The situation calls for evidence that the documented address plan has no overlap and effective routes deliver packets to the intended VNet or site.

That observation would primarily validate another control: use private backend addressing and implement egress separately through a controlled outbound path. Outbound connectivity does not require each backend NIC to carry a public address or accept inbound traffic. The situation calls for evidence that the documented address plan has no overlap and effective routes deliver packets to the intended VNet or site.

That observation would primarily validate another control: plan address-space updates with peering synchronization and dependency validation before routing cutover. Connected peers and gateways must recognize updated prefixes and traffic cannot rely on stale addressing during migration. The situation calls for evidence that the documented address plan has no overlap and effective routes deliver packets to the intended VNet or site.

That observation would primarily validate another control: revoke or deny the specific P2S client certificate by supported gateway configuration and policy. Certificate trust must be able to exclude compromised or retired client certificates. The situation calls for evidence that a permitted user signs in with the intended Entra policy and a rejected identity fails access.

That observation would primarily validate another control: assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. The situation calls for evidence that a permitted user signs in with the intended Entra policy and a rejected identity fails access.

That observation would primarily validate another control: provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration. P2S connection establishes reachability but private DNS lookup depends on client and gateway DNS settings. The situation calls for evidence that a permitted user signs in with the intended Entra policy and a rejected identity fails access.

Private endpoint policy support and traffic paths must be consistent with the desired inspection/segmentation design. However, the option would implement review and configure supported private endpoint network policies and the associated subnet routes deliberately; the scenario instead requires sequence private endpoint approval, private DNS, connectivity testing and then public network restriction. The differentiating evidence is that the application passes private-path tests before public ingress is disabled and stays healthy afterward.

DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. However, the option would implement use individual approved private endpoint connections and enforce data-plane identity authorization; the scenario instead requires sequence private endpoint approval, private DNS, connectivity testing and then public network restriction. The differentiating evidence is that the application passes private-path tests before public ingress is disabled and stays healthy afterward.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires sequence private endpoint approval, private DNS, connectivity testing and then public network restriction. The differentiating evidence is that the application passes private-path tests before public ingress is disabled and stays healthy afterward.

That observation would primarily validate another control: complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. The situation calls for evidence that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

That observation would primarily validate another control: apply supported origin access restrictions using Front Door identification and approved security controls. Public origins need defenses against clients bypassing edge WAF and delivery rules. The situation calls for evidence that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

That observation would primarily validate another control: use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. The situation calls for evidence that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

Managed service and FQDN tags reduce brittle static destination-IP maintenance for supported services. However, the option would implement use supported Azure Firewall FQDN tags or service-aware policy features where applicable; the scenario instead requires enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering. The differentiating evidence is that the client and firewall resolve the intended destination consistently and matching traffic follows the expected rule.

Secured virtual hubs support managed firewall enforcement for connected traffic when routing is configured. However, the option would implement deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy; the scenario instead requires enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering. The differentiating evidence is that the client and firewall resolve the intended destination consistently and matching traffic follows the expected rule.

Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. However, the option would implement create an Azure Firewall application rule scoped to the required FQDN and protocol; the scenario instead requires enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering. The differentiating evidence is that the client and firewall resolve the intended destination consistently and matching traffic follows the expected rule.

WAF policy association and custom rule match conditions determine where application-layer controls apply. However, the option would implement scope and associate appropriate WAF security policies to supported domains or path patterns; the scenario instead requires define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers. The differentiating evidence is that a controlled test shows the intended enforcement layer with consistent logged request identifiers.

A standalone policy object does not inspect traffic until attached to an applicable gateway scope. However, the option would implement associate the WAF policy to the intended Application Gateway scope, listener or route as supported; the scenario instead requires define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers. The differentiating evidence is that a controlled test shows the intended enforcement layer with consistent logged request identifiers.

WAF policies inspect HTTP application requests for known attack patterns rather than replacing NSG port controls. However, the option would implement attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode; the scenario instead requires define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers. The differentiating evidence is that a controlled test shows the intended enforcement layer with consistent logged request identifiers.

That observation would primarily validate another control: deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings. Virtual hubs need relevant gateways to terminate the actual connection type. The situation calls for evidence that an approved risky connection triggers the configured firewall rule while permitted test traffic passes.

That observation would primarily validate another control: deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. The situation calls for evidence that an approved risky connection triggers the configured firewall rule while permitted test traffic passes.

That observation would primarily validate another control: provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits. Virtual WAN gateway components are service-specific; S2S VPN gateway does not terminate ExpressRoute. The situation calls for evidence that an approved risky connection triggers the configured firewall rule while permitted test traffic passes.

That observation would primarily validate another control: deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit. An ExpressRoute circuit alone is not a VNet-to-circuit connection without the gateway or supported architecture. The situation calls for evidence that the two target regions can attach through the designed service and verify permitted test traffic.

That observation would primarily validate another control: provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. ExpressRoute provides private connectivity through a provider path, subject to service and circuit design. The situation calls for evidence that the two target regions can attach through the designed service and verify permitted test traffic.

That observation would primarily validate another control: enable ExpressRoute FastPath on compatible circuits, gateways and network resources. FastPath can improve the data path for supported ExpressRoute configurations by bypassing the gateway dataplane. The situation calls for evidence that the two target regions can attach through the designed service and verify permitted test traffic.

That observation would primarily validate another control: add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. The situation calls for evidence that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

That observation would primarily validate another control: align Application Gateway backend host-name and health-probe configuration with the origin virtual host. Layer-7 backend routing and TLS validation depend on the host and protocol settings. The situation calls for evidence that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

That observation would primarily validate another control: configure a custom Application Gateway health probe with the correct host header, protocol and probe path. Gateway backend health uses probe settings that must match the application's listener and host expectations. The situation calls for evidence that a client TLS handshake presents the intended valid hostname certificate and completes successfully.