That observation would primarily validate another control: add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. The situation calls for evidence that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

That observation would primarily validate another control: align Application Gateway backend host-name and health-probe configuration with the origin virtual host. Layer-7 backend routing and TLS validation depend on the host and protocol settings. The situation calls for evidence that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

That observation would primarily validate another control: configure a custom Application Gateway health probe with the correct host header, protocol and probe path. Gateway backend health uses probe settings that must match the application's listener and host expectations. The situation calls for evidence that a client TLS handshake presents the intended valid hostname certificate and completes successfully.

That observation would primarily validate another control: reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility. Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. The situation calls for evidence that updated effective routes reflect the new prefixes and representative traffic works before old addresses are removed.

That observation would primarily validate another control: use private backend addressing and implement egress separately through a controlled outbound path. Outbound connectivity does not require each backend NIC to carry a public address or accept inbound traffic. The situation calls for evidence that updated effective routes reflect the new prefixes and representative traffic works before old addresses are removed.

That observation would primarily validate another control: allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity. Peering and hybrid routing require unambiguous destinations; overlapping prefixes prevent intended reachability. The situation calls for evidence that updated effective routes reflect the new prefixes and representative traffic works before old addresses are removed.

That observation would primarily validate another control: enable hub gateway transit and compatible remote-gateway peering usage on the spoke. Gateway transit makes the shared hub VPN connection available to eligible peered spokes. The situation calls for evidence that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

That observation would primarily validate another control: resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S. Identical local and remote prefixes make destination routing ambiguous across a site-to-site tunnel. The situation calls for evidence that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

That observation would primarily validate another control: update the local network gateway resource with the remote VPN device public IP and correct prefixes. Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. The situation calls for evidence that a branch test to an approved Internet destination is logged at the Azure inspection hop with correct return traffic.

Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. However, the option would implement add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing; the scenario instead requires configure an Application Gateway rewrite rule set matching the required request or response conditions. The differentiating evidence is that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

Application Gateway has subnet placement and IP capacity requirements distinct from backend pools. However, the option would implement move the gateway into a supported dedicated subnet with adequate addresses for expected scaling; the scenario instead requires configure an Application Gateway rewrite rule set matching the required request or response conditions. The differentiating evidence is that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

URL path maps select backend targets on HTTP path matches, with default behavior for other paths. However, the option would implement configure path-based routing rules and suitable default backend pool in Application Gateway; the scenario instead requires configure an Application Gateway rewrite rule set matching the required request or response conditions. The differentiating evidence is that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

That observation would primarily validate another control: configure an Application Gateway rewrite rule set matching the required request or response conditions. Rewrite rules modify supported HTTP header and URL aspects without requiring changes in every backend service. The situation calls for evidence that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

That observation would primarily validate another control: attach a supported Application Gateway WAF policy in the intended enforcement mode. Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. The situation calls for evidence that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

That observation would primarily validate another control: deploy Azure Application Gateway with HTTPS listener and path-based routing rules. Application Gateway provides regional layer-7 routing and TLS termination for HTTP services. The situation calls for evidence that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

Front Door WAF evaluates incoming HTTP requests at the edge before routing to origins. However, the option would implement associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns; the scenario instead requires configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates. The differentiating evidence is that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

A route connects domain/path matching with the origin group and forwarding behavior. However, the option would implement create specific Front Door routes matching the intended domain and path patterns to origin groups; the scenario instead requires configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates. The differentiating evidence is that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. However, the option would implement complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate; the scenario instead requires configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates. The differentiating evidence is that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

That observation would primarily validate another control: replace blanket allows with least-privilege application and network rule collections. Central inspection is effective only if the policy meaningfully restricts destination and transport access. The situation calls for evidence that selected firewall tier supports required rules and monitored traffic stays within capacity.

That observation would primarily validate another control: combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth. NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. The situation calls for evidence that selected firewall tier supports required rules and monitored traffic stays within capacity.

That observation would primarily validate another control: correlate firewall decision logs with source and destination effective routes and return connectivity. A rule allow is not sufficient when a request or response never passes the expected firewall path. The situation calls for evidence that selected firewall tier supports required rules and monitored traffic stays within capacity.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires use a Private Link service with explicit connection approval and supported provider NAT configuration. The differentiating evidence is that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

Private DNS zone visibility follows VNet links and resolution architecture, not merely peering topology. However, the option would implement plan consistent private DNS zone links or resolver forwarding across the client VNets; the scenario instead requires use a Private Link service with explicit connection approval and supported provider NAT configuration. The differentiating evidence is that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

Private endpoint connectivity depends on the destination service's supported private link capabilities. However, the option would implement check resource-specific Private Link support, subresource group IDs and regional availability before implementation; the scenario instead requires use a Private Link service with explicit connection approval and supported provider NAT configuration. The differentiating evidence is that an approved tenant resolves and uses the consumer endpoint while no general VNet-to-VNet route is required.

Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. However, the option would implement provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway; the scenario instead requires plan address-space updates with peering synchronization and dependency validation before routing cutover. The differentiating evidence is that updated effective routes reflect the new prefixes and representative traffic works before old addresses are removed.

Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. However, the option would implement place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets; the scenario instead requires plan address-space updates with peering synchronization and dependency validation before routing cutover. The differentiating evidence is that updated effective routes reflect the new prefixes and representative traffic works before old addresses are removed.

Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. However, the option would implement reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility; the scenario instead requires plan address-space updates with peering synchronization and dependency validation before routing cutover. The differentiating evidence is that updated effective routes reflect the new prefixes and representative traffic works before old addresses are removed.

That observation would primarily validate another control: deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. The situation calls for evidence that a controlled single-tunnel interruption leaves the alternate tunnel carrying authorized network traffic.

That observation would primarily validate another control: enable hub gateway transit and compatible remote-gateway peering usage on the spoke. Gateway transit makes the shared hub VPN connection available to eligible peered spokes. The situation calls for evidence that a controlled single-tunnel interruption leaves the alternate tunnel carrying authorized network traffic.

That observation would primarily validate another control: update the local network gateway resource with the remote VPN device public IP and correct prefixes. Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. The situation calls for evidence that a controlled single-tunnel interruption leaves the alternate tunnel carrying authorized network traffic.

Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. However, the option would implement create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet; the scenario instead requires use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs. The differentiating evidence is that the validated custom prefix reaches the commissioned state and allocated resource IPs are in the owned block.

Subnet delegation is scoped to supported service providers and imposes placement constraints. However, the option would implement choose the service-supported delegated subnet and remove incompatible delegation or workload placements; the scenario instead requires use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs. The differentiating evidence is that the validated custom prefix reaches the commissioned state and allocated resource IPs are in the owned block.

Reproducible network definitions and validation catch overlapping or noncompliant ranges before live peering. However, the option would implement define address and segmentation standards in IaC with governance checks before production deployment; the scenario instead requires use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs. The differentiating evidence is that the validated custom prefix reaches the commissioned state and allocated resource IPs are in the owned block.