FastPath can improve the data path for supported ExpressRoute configurations by bypassing the gateway dataplane. However, the option would implement enable ExpressRoute FastPath on compatible circuits, gateways and network resources; the scenario instead requires inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. The differentiating evidence is that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

ExpressRoute provides private connectivity through a provider path, subject to service and circuit design. However, the option would implement provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering; the scenario instead requires inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. The differentiating evidence is that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. However, the option would implement select an ExpressRoute SKU and connectivity design that supports the needed geographic reach; the scenario instead requires inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection. The differentiating evidence is that the effective path selects the ExpressRoute-connected gateway for the intended prefixes and test latency normalizes.

That observation would primarily validate another control: use supported Azure Firewall FQDN tags or service-aware policy features where applicable. Managed service and FQDN tags reduce brittle static destination-IP maintenance for supported services. The situation calls for evidence that a permitted destination is reachable and an unauthorized FQDN is blocked with an identifiable firewall log.

That observation would primarily validate another control: enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering. FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. The situation calls for evidence that a permitted destination is reachable and an unauthorized FQDN is blocked with an identifiable firewall log.

That observation would primarily validate another control: correlate firewall decision logs with source and destination effective routes and return connectivity. A rule allow is not sufficient when a request or response never passes the expected firewall path. The situation calls for evidence that a permitted destination is reachable and an unauthorized FQDN is blocked with an identifiable firewall log.

Certificate trust must be able to exclude compromised or retired client certificates. However, the option would implement revoke or deny the specific P2S client certificate by supported gateway configuration and policy; the scenario instead requires constrain client routing and enforce destination access with NSGs and identity-aware controls. The differentiating evidence is that the contractor can access the approved project service but an unauthorized sensitive subnet is blocked.

P2S gateway SKU limits and client tunnel health are distinct from account credential validity. However, the option would implement inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls; the scenario instead requires constrain client routing and enforce destination access with NSGs and identity-aware controls. The differentiating evidence is that the contractor can access the approved project service but an unauthorized sensitive subnet is blocked.

Always On VPN is a client-side management design with specific tunnel and infrastructure requirements. However, the option would implement validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration; the scenario instead requires constrain client routing and enforce destination access with NSGs and identity-aware controls. The differentiating evidence is that the contractor can access the approved project service but an unauthorized sensitive subnet is blocked.

That observation would primarily validate another control: start the WAF in detection mode, review matched rules and then enable prevention after tuning. Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. The situation calls for evidence that the payment use case succeeds and approved safe attack tests still trigger expected protection.

That observation would primarily validate another control: associate the WAF policy to the intended Application Gateway scope, listener or route as supported. A standalone policy object does not inspect traffic until attached to an applicable gateway scope. The situation calls for evidence that the payment use case succeeds and approved safe attack tests still trigger expected protection.

That observation would primarily validate another control: associate a Front Door WAF policy with the intended endpoint domains through a security policy. Front Door WAF applies application-layer filtering at the Microsoft edge for protected routes. The situation calls for evidence that the payment use case succeeds and approved safe attack tests still trigger expected protection.

Frontend IP and listener bindings determine which network scope can reach each Application Gateway site. However, the option would implement configure supported internal and public frontend IP configurations and bind listeners to the intended frontend; the scenario instead requires align Application Gateway backend host-name and health-probe configuration with the origin virtual host. The differentiating evidence is that the probe stops reporting hostname errors and a client request reaches the correct virtual host.

Gateway backend health uses probe settings that must match the application's listener and host expectations. However, the option would implement configure a custom Application Gateway health probe with the correct host header, protocol and probe path; the scenario instead requires align Application Gateway backend host-name and health-probe configuration with the origin virtual host. The differentiating evidence is that the probe stops reporting hostname errors and a client request reaches the correct virtual host.

Rewrite rules modify supported HTTP header and URL aspects without requiring changes in every backend service. However, the option would implement configure an Application Gateway rewrite rule set matching the required request or response conditions; the scenario instead requires align Application Gateway backend host-name and health-probe configuration with the origin virtual host. The differentiating evidence is that the probe stops reporting hostname errors and a client request reaches the correct virtual host.

NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. However, the option would implement attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet; the scenario instead requires configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. The differentiating evidence is that the spoke effective routes include on-premises prefixes and branch application traffic passes the gateway.

Centralized change definitions make route and topology deviations detectable before deployment. However, the option would implement deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations; the scenario instead requires configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. The differentiating evidence is that the spoke effective routes include on-premises prefixes and branch application traffic passes the gateway.

User-defined routes direct selected prefixes through a network virtual appliance when transparent inspection is required. However, the option would implement associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop; the scenario instead requires configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. The differentiating evidence is that the spoke effective routes include on-premises prefixes and branch application traffic passes the gateway.

The client-to-edge and edge-to-origin TLS connections are distinct and must both be configured. However, the option would implement configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates; the scenario instead requires use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. The differentiating evidence is that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

A route connects domain/path matching with the origin group and forwarding behavior. However, the option would implement create specific Front Door routes matching the intended domain and path patterns to origin groups; the scenario instead requires use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. The differentiating evidence is that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

Front Door WAF evaluates incoming HTTP requests at the edge before routing to origins. However, the option would implement associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns; the scenario instead requires use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. The differentiating evidence is that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

That observation would primarily validate another control: associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop. User-defined routes direct selected prefixes through a network virtual appliance when transparent inspection is required. The situation calls for evidence that a probe between spokes follows the approved transit hop and reverse traffic returns over a valid path.

That observation would primarily validate another control: use Azure Route Server with a supported BGP peer to exchange routes dynamically. Route Server exchanges BGP information with compatible appliances and Azure networking instead of relying on static edits. The situation calls for evidence that a probe between spokes follows the approved transit hop and reverse traffic returns over a valid path.

That observation would primarily validate another control: inspect peering status, route propagation and effective routes before changing security policies. Control-plane connectivity and data-plane path selection must be diagnosed separately. The situation calls for evidence that a probe between spokes follows the approved transit hop and reverse traffic returns over a valid path.

Circuit health and private peering do not guarantee a workload selects that route over more specific UDR entries. However, the option would implement inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection; the scenario instead requires choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning. The differentiating evidence is that the contracted connectivity provider provisions the selected handoff and the circuit enters a usable state.

Global Reach connects supported on-premises networks through eligible ExpressRoute circuit relationships. However, the option would implement use ExpressRoute Global Reach between eligible circuits and confirm support across their locations; the scenario instead requires choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning. The differentiating evidence is that the contracted connectivity provider provisions the selected handoff and the circuit enters a usable state.

ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. However, the option would implement select an ExpressRoute SKU and connectivity design that supports the needed geographic reach; the scenario instead requires choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning. The differentiating evidence is that the contracted connectivity provider provisions the selected handoff and the circuit enters a usable state.

That observation would primarily validate another control: configure suitable load-balancing rules including HA ports where the chosen internal design supports them. Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. The situation calls for evidence that connecting to the assigned frontend management port consistently reaches the intended backend instance.

That observation would primarily validate another control: configure an eligible health probe and backend listener that match the service port and NSG rules. Load Balancer health probes decide which backends are eligible for new flows. The situation calls for evidence that connecting to the assigned frontend management port consistently reaches the intended backend instance.

That observation would primarily validate another control: configure appropriate Load Balancer probe and rollout health gating for backend readiness. Probe-driven backend health prevents new flows from being distributed to failing endpoints. The situation calls for evidence that connecting to the assigned frontend management port consistently reaches the intended backend instance.

Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. However, the option would implement reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility; the scenario instead requires associate a supported static public IP resource with the correct VM network interface configuration. The differentiating evidence is that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

Reproducible network definitions and validation catch overlapping or noncompliant ranges before live peering. However, the option would implement define address and segmentation standards in IaC with governance checks before production deployment; the scenario instead requires associate a supported static public IP resource with the correct VM network interface configuration. The differentiating evidence is that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires associate a supported static public IP resource with the correct VM network interface configuration. The differentiating evidence is that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.