Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. However, the option would implement reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility; the scenario instead requires associate a supported static public IP resource with the correct VM network interface configuration. The differentiating evidence is that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

Reproducible network definitions and validation catch overlapping or noncompliant ranges before live peering. However, the option would implement define address and segmentation standards in IaC with governance checks before production deployment; the scenario instead requires associate a supported static public IP resource with the correct VM network interface configuration. The differentiating evidence is that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires associate a supported static public IP resource with the correct VM network interface configuration. The differentiating evidence is that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

That observation would primarily validate another control: change the tuned WAF policy to prevention mode and confirm the intended managed rule action. Prevention mode can block matching HTTP requests, while detection mode is nonblocking. The situation calls for evidence that the legitimate form succeeds and unrelated malicious-pattern test traffic remains blocked.

That observation would primarily validate another control: attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode. WAF policies inspect HTTP application requests for known attack patterns rather than replacing NSG port controls. The situation calls for evidence that the legitimate form succeeds and unrelated malicious-pattern test traffic remains blocked.

That observation would primarily validate another control: scope and associate appropriate WAF security policies to supported domains or path patterns. WAF policy association and custom rule match conditions determine where application-layer controls apply. The situation calls for evidence that the legitimate form succeeds and unrelated malicious-pattern test traffic remains blocked.

Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. However, the option would implement configure hub gateway transit and enable use of remote gateways on the eligible spoke peering; the scenario instead requires place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs. The differentiating evidence is that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

UDRs affect only subnets to which their route table is associated. However, the option would implement associate the intended route table with every subnet that must use that UDR policy; the scenario instead requires place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs. The differentiating evidence is that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

Forced tunneling through an appliance requires an explicit default route from the workload subnet. However, the option would implement apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop; the scenario instead requires place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs. The differentiating evidence is that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

Connected peers and gateways must recognize updated prefixes and traffic cannot rely on stale addressing during migration. However, the option would implement plan address-space updates with peering synchronization and dependency validation before routing cutover; the scenario instead requires place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets. The differentiating evidence is that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

Subnet delegation is scoped to supported service providers and imposes placement constraints. However, the option would implement choose the service-supported delegated subnet and remove incompatible delegation or workload placements; the scenario instead requires place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets. The differentiating evidence is that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. However, the option would implement provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway; the scenario instead requires place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets. The differentiating evidence is that the gateway deployment succeeds and its health probe reports available backends across the intended subnet boundary.

Correct name resolution does not create connectivity; routing, firewall and endpoint access still matter. However, the option would implement validate DNS resolution separately from IP routing and provide an approved private network path; the scenario instead requires deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP. The differentiating evidence is that on-premises nslookup against the conditional forwarder returns the expected Azure private address.

DNS caching can delay a record change independently of network route availability. However, the option would implement reduce record TTL before a planned migration and validate propagation and client cache expiry; the scenario instead requires deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP. The differentiating evidence is that on-premises nslookup against the conditional forwarder returns the expected Azure private address.

DNS record types have distinct purposes: A provides IPv4 host resolution while MX selects mail exchangers. However, the option would implement create appropriate public-zone A records for IPv4 and MX records for mail routing; the scenario instead requires deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP. The differentiating evidence is that on-premises nslookup against the conditional forwarder returns the expected Azure private address.

Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. However, the option would implement assign a distinct nonoverlapping P2S client address pool and republish the client configuration; the scenario instead requires choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. The differentiating evidence is that clients on approved platforms negotiate the selected tunnel and connect to the allowed subnet.

VPN authentication alone does not install all required routes to remote interconnected networks. However, the option would implement review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes; the scenario instead requires choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. The differentiating evidence is that clients on approved platforms negotiate the selected tunnel and connect to the allowed subnet.

RADIUS authentication depends on an accessible server and consistent protocol/authentication configuration. However, the option would implement configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets; the scenario instead requires choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. The differentiating evidence is that clients on approved platforms negotiate the selected tunnel and connect to the allowed subnet.

Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. However, the option would implement deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies; the scenario instead requires deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections. The differentiating evidence is that an authorized branch-to-spoke and hub-to-hub test follows the expected managed routing path.

Virtual WAN hub interconnect and route propagation control cross-region VNet path availability. However, the option would implement check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions; the scenario instead requires deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections. The differentiating evidence is that an authorized branch-to-spoke and hub-to-hub test follows the expected managed routing path.

Virtual WAN gateway components are service-specific; S2S VPN gateway does not terminate ExpressRoute. However, the option would implement provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits; the scenario instead requires deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections. The differentiating evidence is that an authorized branch-to-spoke and hub-to-hub test follows the expected managed routing path.

That observation would primarily validate another control: enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. The situation calls for evidence that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

That observation would primarily validate another control: attach a supported Application Gateway WAF policy in the intended enforcement mode. Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. The situation calls for evidence that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

That observation would primarily validate another control: configure an Application Gateway redirect configuration associated with the right listener or rule. HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. The situation calls for evidence that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

That observation would primarily validate another control: verify the service's VNet integration outbound route and private DNS configuration in the integration environment. The caller's own network integration and resolver path control whether it can use a private endpoint. The situation calls for evidence that the service FQDN resolves to the private endpoint IP and a client connects successfully.

That observation would primarily validate another control: check resource-specific Private Link support, subresource group IDs and regional availability before implementation. Private endpoint connectivity depends on the destination service's supported private link capabilities. The situation calls for evidence that the service FQDN resolves to the private endpoint IP and a client connects successfully.

That observation would primarily validate another control: remove or reject only the obsolete private endpoint connection and clean up its DNS records. Private Link consumer connections can be managed individually without deleting the underlying PaaS resource. The situation calls for evidence that the service FQDN resolves to the private endpoint IP and a client connects successfully.

Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. However, the option would implement configure hub gateway transit and enable use of remote gateways on the eligible spoke peering; the scenario instead requires review effective routes and keep the explicit appliance route when inspected forced tunneling is required. The differentiating evidence is that a test VM's effective route and packet path show the intended appliance rather than unexpected NAT egress.

Control-plane connectivity and data-plane path selection must be diagnosed separately. However, the option would implement inspect peering status, route propagation and effective routes before changing security policies; the scenario instead requires review effective routes and keep the explicit appliance route when inspected forced tunneling is required. The differentiating evidence is that a test VM's effective route and packet path show the intended appliance rather than unexpected NAT egress.

Direct VNet peering does not resolve overlapping address-space ambiguity. However, the option would implement renumber overlapping VNet address spaces before peering or design a supported translation boundary; the scenario instead requires review effective routes and keep the explicit appliance route when inspected forced tunneling is required. The differentiating evidence is that a test VM's effective route and packet path show the intended appliance rather than unexpected NAT egress.

Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. However, the option would implement use Defender for Cloud Cloud Security Explorer to query related security posture resources; the scenario instead requires inventory DDoS protection plan associations and protected public IP resources in governance checks. The differentiating evidence is that an inventory query flags uncovered endpoints and shows the expected protection association after correction.

Effective NSG evaluation identifies the allow or deny rule governing a specific flow. However, the option would implement use Network Watcher IP flow verify or effective security rules for the exact source/destination tuple; the scenario instead requires inventory DDoS protection plan associations and protected public IP resources in governance checks. The differentiating evidence is that an inventory query flags uncovered endpoints and shows the expected protection association after correction.

DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. However, the option would implement enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs; the scenario instead requires inventory DDoS protection plan associations and protected public IP resources in governance checks. The differentiating evidence is that an inventory query flags uncovered endpoints and shows the expected protection association after correction.