Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. However, the option would implement create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet; the scenario instead requires use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs. The differentiating evidence is that the validated custom prefix reaches the commissioned state and allocated resource IPs are in the owned block.

Subnet delegation is scoped to supported service providers and imposes placement constraints. However, the option would implement choose the service-supported delegated subnet and remove incompatible delegation or workload placements; the scenario instead requires use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs. The differentiating evidence is that the validated custom prefix reaches the commissioned state and allocated resource IPs are in the owned block.

Reproducible network definitions and validation catch overlapping or noncompliant ranges before live peering. However, the option would implement define address and segmentation standards in IaC with governance checks before production deployment; the scenario instead requires use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs. The differentiating evidence is that the validated custom prefix reaches the commissioned state and allocated resource IPs are in the owned block.

That observation would primarily validate another control: register eligible NIC IP configurations or supported resources in the load balancer backend pool. Load balancing applies only to members registered in its backend pool and passing health checks. The situation calls for evidence that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

That observation would primarily validate another control: configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules. High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. The situation calls for evidence that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

That observation would primarily validate another control: deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes. Public Load Balancer distributes layer-4 flows across healthy backends without inspecting URL paths. The situation calls for evidence that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

That observation would primarily validate another control: create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints. Inbound and outbound resolver endpoints use dedicated subnets that cannot host unrelated workloads. The situation calls for evidence that a newly deployed test VM appears in the zone and resolves from a permitted linked VNet.

That observation would primarily validate another control: create appropriate public-zone A records for IPv4 and MX records for mail routing. DNS record types have distinct purposes: A provides IPv4 host resolution while MX selects mail exchangers. The situation calls for evidence that a newly deployed test VM appears in the zone and resolves from a permitted linked VNet.

That observation would primarily validate another control: configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. Outbound endpoints and forwarding rules let Azure-resident clients resolve selected external DNS namespaces. The situation calls for evidence that a newly deployed test VM appears in the zone and resolves from a permitted linked VNet.

That observation would primarily validate another control: enable appropriate forwarded traffic settings on the relevant peering connections and retain correct return routes. Traffic forwarded by an NVA requires compatible peering settings as well as layer-3 routing. The situation calls for evidence that the destination prefixes no longer overlap and peering establishes without address collision errors.

That observation would primarily validate another control: apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. Forced tunneling through an appliance requires an explicit default route from the workload subnet. The situation calls for evidence that the destination prefixes no longer overlap and peering establishes without address collision errors.

That observation would primarily validate another control: configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. The situation calls for evidence that the destination prefixes no longer overlap and peering establishes without address collision errors.

That observation would primarily validate another control: constrain client routing and enforce destination access with NSGs and identity-aware controls. P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. The situation calls for evidence that an authorized remote device connects and reaches an approved private Azure subnet.

That observation would primarily validate another control: revoke or deny the specific P2S client certificate by supported gateway configuration and policy. Certificate trust must be able to exclude compromised or retired client certificates. The situation calls for evidence that an authorized remote device connects and reaches an approved private Azure subnet.

That observation would primarily validate another control: configure P2S root certificate trust and issue valid client certificates from the approved CA. Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. The situation calls for evidence that an authorized remote device connects and reaches an approved private Azure subnet.

That observation would primarily validate another control: provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall. Azure Firewall uses a specific reserved subnet name and supported minimum capacity for deployment and scaling. The situation calls for evidence that future-service subnet reservations fit without overlapping or requiring emergency VNet renumbering.

That observation would primarily validate another control: allocate a Public IP Prefix and create supported public IP resources from that prefix. Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. The situation calls for evidence that future-service subnet reservations fit without overlapping or requiring emergency VNet renumbering.

That observation would primarily validate another control: associate a supported static public IP resource with the correct VM network interface configuration. A standalone VM public IP attachment belongs to a NIC IP configuration and a static allocation preserves its address. The situation calls for evidence that future-service subnet reservations fit without overlapping or requiring emergency VNet renumbering.

That observation would primarily validate another control: review effective routes and keep the explicit appliance route when inspected forced tunneling is required. A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. The situation calls for evidence that the corrected NIC effective route points to the approved gateway and the application test succeeds.

That observation would primarily validate another control: use Azure Route Server with a supported BGP peer to exchange routes dynamically. Route Server exchanges BGP information with compatible appliances and Azure networking instead of relying on static edits. The situation calls for evidence that the corrected NIC effective route points to the approved gateway and the application test succeeds.

That observation would primarily validate another control: renumber overlapping VNet address spaces before peering or design a supported translation boundary. Direct VNet peering does not resolve overlapping address-space ambiguity. The situation calls for evidence that the corrected NIC effective route points to the approved gateway and the application test succeeds.

Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. However, the option would implement complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate; the scenario instead requires use Front Door Premium Private Link origin connectivity and configure compatible origin private access. The differentiating evidence is that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

Front Door is a globally distributed application delivery service that proxies and routes HTTP(S) traffic to healthy origins. However, the option would implement deploy Azure Front Door with appropriate origin groups and endpoint routes; the scenario instead requires use Front Door Premium Private Link origin connectivity and configure compatible origin private access. The differentiating evidence is that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

Front Door cache purging invalidates stale edge copies in supported scopes. However, the option would implement use the supported Front Door purge cache operation for affected URL patterns; the scenario instead requires use Front Door Premium Private Link origin connectivity and configure compatible origin private access. The differentiating evidence is that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

DNS record types have distinct purposes: A provides IPv4 host resolution while MX selects mail exchangers. However, the option would implement create appropriate public-zone A records for IPv4 and MX records for mail routing; the scenario instead requires link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path. The differentiating evidence is that an on-premises query through the inbound endpoint returns the expected zone record rather than NXDOMAIN.

Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. However, the option would implement enable autoregistration for the appropriate VNet link to an Azure Private DNS zone; the scenario instead requires link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path. The differentiating evidence is that an on-premises query through the inbound endpoint returns the expected zone record rather than NXDOMAIN.

DNS-layer policy can block known malicious domains without treating an IP firewall allow rule as DNS security. However, the option would implement apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope; the scenario instead requires link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path. The differentiating evidence is that an on-premises query through the inbound endpoint returns the expected zone record rather than NXDOMAIN.

Service endpoint enablement alone does not grant access at the PaaS service network policy layer. However, the option would implement add the selected VNet/subnet to the target service's virtual network access rules; the scenario instead requires choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. The differentiating evidence is that the service firewall sees the allowed VNet/subnet and rejects requests from unapproved networks.

Moving to Private Link requires validating both name resolution and authorization before retiring former service access. However, the option would implement verify the intended private endpoint DNS and reachability, then remove obsolete service endpoint rules deliberately; the scenario instead requires choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. The differentiating evidence is that the service firewall sees the allowed VNet/subnet and rejects requests from unapproved networks.

Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. However, the option would implement use a private endpoint instead of a service endpoint for private-IP service access; the scenario instead requires choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. The differentiating evidence is that the service firewall sees the allowed VNet/subnet and rejects requests from unapproved networks.

Private endpoints can serve on-premises clients when DNS and private routing to the VNet are established. However, the option would implement route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS; the scenario instead requires check resource-specific Private Link support, subresource group IDs and regional availability before implementation. The differentiating evidence is that the selected service and group ID validate and the endpoint connection provisions successfully.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires check resource-specific Private Link support, subresource group IDs and regional availability before implementation. The differentiating evidence is that the selected service and group ID validate and the endpoint connection provisions successfully.

A provider Private Link service can expose eligible private load-balanced workloads to consumer subscriptions. However, the option would implement use a Private Link service with explicit connection approval and supported provider NAT configuration; the scenario instead requires check resource-specific Private Link support, subresource group IDs and regional availability before implementation. The differentiating evidence is that the selected service and group ID validate and the endpoint connection provisions successfully.