Private endpoints can serve on-premises clients when DNS and private routing to the VNet are established. However, the option would implement route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS; the scenario instead requires check resource-specific Private Link support, subresource group IDs and regional availability before implementation. The differentiating evidence is that the selected service and group ID validate and the endpoint connection provisions successfully.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires check resource-specific Private Link support, subresource group IDs and regional availability before implementation. The differentiating evidence is that the selected service and group ID validate and the endpoint connection provisions successfully.

A provider Private Link service can expose eligible private load-balanced workloads to consumer subscriptions. However, the option would implement use a Private Link service with explicit connection approval and supported provider NAT configuration; the scenario instead requires check resource-specific Private Link support, subresource group IDs and regional availability before implementation. The differentiating evidence is that the selected service and group ID validate and the endpoint connection provisions successfully.

Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. However, the option would implement configure appropriate multi-site listeners and host-based routing rules on Application Gateway; the scenario instead requires deploy Azure Application Gateway with HTTPS listener and path-based routing rules. The differentiating evidence is that requests to each URL path reach the intended healthy backend with a valid TLS response.

HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. However, the option would implement configure an Application Gateway redirect configuration associated with the right listener or rule; the scenario instead requires deploy Azure Application Gateway with HTTPS listener and path-based routing rules. The differentiating evidence is that requests to each URL path reach the intended healthy backend with a valid TLS response.

Gateway backend health uses probe settings that must match the application's listener and host expectations. However, the option would implement configure a custom Application Gateway health probe with the correct host header, protocol and probe path; the scenario instead requires deploy Azure Application Gateway with HTTPS listener and path-based routing rules. The differentiating evidence is that requests to each URL path reach the intended healthy backend with a valid TLS response.

That observation would primarily validate another control: place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets. Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. The situation calls for evidence that test packets follow the correct subnet route and the intended allow or deny decision is recorded.

That observation would primarily validate another control: allocate a Public IP Prefix and create supported public IP resources from that prefix. Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. The situation calls for evidence that test packets follow the correct subnet route and the intended allow or deny decision is recorded.

That observation would primarily validate another control: add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. The situation calls for evidence that test packets follow the correct subnet route and the intended allow or deny decision is recorded.

Front Door WAF evaluates incoming HTTP requests at the edge before routing to origins. However, the option would implement associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns; the scenario instead requires apply supported origin access restrictions using Front Door identification and approved security controls. The differentiating evidence is that a request through Front Door succeeds and an unrelated direct-origin test is rejected.

Edge origin health assessment should use a consistently reachable probe without costly application side effects. However, the option would implement configure an appropriate lightweight unauthenticated Front Door origin health probe path; the scenario instead requires apply supported origin access restrictions using Front Door identification and approved security controls. The differentiating evidence is that a request through Front Door succeeds and an unrelated direct-origin test is rejected.

Front Door rules can modify edge request handling before forwarding to origin services. However, the option would implement create Front Door rules for supported redirect or URL rewrite behavior on the matching route; the scenario instead requires apply supported origin access restrictions using Front Door identification and approved security controls. The differentiating evidence is that a request through Front Door succeeds and an unrelated direct-origin test is rejected.

Gateway, Bastion, Firewall, private endpoint and application delivery components require space and specific subnet planning. However, the option would implement create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services; the scenario instead requires place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets. The differentiating evidence is that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. However, the option would implement use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources; the scenario instead requires place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets. The differentiating evidence is that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

Outbound connectivity does not require each backend NIC to carry a public address or accept inbound traffic. However, the option would implement use private backend addressing and implement egress separately through a controlled outbound path; the scenario instead requires place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets. The differentiating evidence is that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

Basic, Standard and Premium tiers have different security capabilities and capacity. However, the option would implement choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost; the scenario instead requires deploy Azure Firewall into a supported hub and route workload egress through its private IP. The differentiating evidence is that a permitted destination is reachable and an unauthorized FQDN is blocked with an identifiable firewall log.

Hierarchical policies provide centralized baselines while allowing controlled local additions. However, the option would implement use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies; the scenario instead requires deploy Azure Firewall into a supported hub and route workload egress through its private IP. The differentiating evidence is that a permitted destination is reachable and an unauthorized FQDN is blocked with an identifiable firewall log.

FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires deploy Azure Firewall into a supported hub and route workload egress through its private IP. The differentiating evidence is that a permitted destination is reachable and an unauthorized FQDN is blocked with an identifiable firewall log.

High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. However, the option would implement configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules; the scenario instead requires configure an eligible health probe and backend listener that match the service port and NSG rules. The differentiating evidence is that the probe reports healthy for the running service and external requests reach the backend.

Gateway Load Balancer integrates compatible NVAs into traffic flow without application-layer URL routing. However, the option would implement use Gateway Load Balancer and a supported transparent NVA service-chain configuration; the scenario instead requires configure an eligible health probe and backend listener that match the service port and NSG rules. The differentiating evidence is that the probe reports healthy for the running service and external requests reach the backend.

Load balancing applies only to members registered in its backend pool and passing health checks. However, the option would implement register eligible NIC IP configurations or supported resources in the load balancer backend pool; the scenario instead requires configure an eligible health probe and backend listener that match the service port and NSG rules. The differentiating evidence is that the probe reports healthy for the running service and external requests reach the backend.

That observation would primarily validate another control: assign a distinct nonoverlapping P2S client address pool and republish the client configuration. Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. The situation calls for evidence that the contractor can access the approved project service but an unauthorized sensitive subnet is blocked.

That observation would primarily validate another control: regenerate and distribute the appropriate Azure VPN client configuration profile after gateway changes. Client settings must match the endpoint, routes and auth mode configured on the gateway. The situation calls for evidence that the contractor can access the approved project service but an unauthorized sensitive subnet is blocked.

That observation would primarily validate another control: revoke or deny the specific P2S client certificate by supported gateway configuration and policy. Certificate trust must be able to exclude compromised or retired client certificates. The situation calls for evidence that the contractor can access the approved project service but an unauthorized sensitive subnet is blocked.

That observation would primarily validate another control: choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed. Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. The situation calls for evidence that a newly advertised test branch prefix appears in Azure learned routes and is reachable.

That observation would primarily validate another control: assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply. Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. The situation calls for evidence that a newly advertised test branch prefix appears in Azure learned routes and is reachable.

That observation would primarily validate another control: configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints. Active-active VPN gateway instances can provide redundant tunnel paths when peer devices support the design. The situation calls for evidence that a newly advertised test branch prefix appears in Azure learned routes and is reachable.

Private Link connectivity commonly depends on the appropriate privatelink DNS zone and VNet link. However, the option would implement create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs; the scenario instead requires validate DNS resolution separately from IP routing and provide an approved private network path. The differentiating evidence is that the branch resolves the correct private IP and a protocol-level connection succeeds over the authorized route.

Outbound endpoints and forwarding rules let Azure-resident clients resolve selected external DNS namespaces. However, the option would implement configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix; the scenario instead requires validate DNS resolution separately from IP routing and provide an approved private network path. The differentiating evidence is that the branch resolves the correct private IP and a protocol-level connection succeeds over the authorized route.

Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. However, the option would implement create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers; the scenario instead requires validate DNS resolution separately from IP routing and provide an approved private network path. The differentiating evidence is that the branch resolves the correct private IP and a protocol-level connection succeeds over the authorized route.

That observation would primarily validate another control: design Virtual WAN traffic security explicitly with compatible firewall and routing features. Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. The situation calls for evidence that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

That observation would primarily validate another control: deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings. Virtual hubs need relevant gateways to terminate the actual connection type. The situation calls for evidence that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

That observation would primarily validate another control: deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. The situation calls for evidence that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.