Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. However, the option would implement use Defender for Cloud Cloud Security Explorer to query related security posture resources; the scenario instead requires inventory DDoS protection plan associations and protected public IP resources in governance checks. The differentiating evidence is that an inventory query flags uncovered endpoints and shows the expected protection association after correction.

Effective NSG evaluation identifies the allow or deny rule governing a specific flow. However, the option would implement use Network Watcher IP flow verify or effective security rules for the exact source/destination tuple; the scenario instead requires inventory DDoS protection plan associations and protected public IP resources in governance checks. The differentiating evidence is that an inventory query flags uncovered endpoints and shows the expected protection association after correction.

DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. However, the option would implement enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs; the scenario instead requires inventory DDoS protection plan associations and protected public IP resources in governance checks. The differentiating evidence is that an inventory query flags uncovered endpoints and shows the expected protection association after correction.

That observation would primarily validate another control: configure Traffic Manager Weighted routing across the regional endpoints. Weighted Traffic Manager policies influence DNS answer distribution across eligible healthy endpoints. The situation calls for evidence that dNS answers choose an eligible healthy endpoint and switch after a controlled failure within expected TTL behavior.

That observation would primarily validate another control: configure appropriate Load Balancer probe and rollout health gating for backend readiness. Probe-driven backend health prevents new flows from being distributed to failing endpoints. The situation calls for evidence that dNS answers choose an eligible healthy endpoint and switch after a controlled failure within expected TTL behavior.

That observation would primarily validate another control: register eligible NIC IP configurations or supported resources in the load balancer backend pool. Load balancing applies only to members registered in its backend pool and passing health checks. The situation calls for evidence that dNS answers choose an eligible healthy endpoint and switch after a controlled failure within expected TTL behavior.

Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. However, the option would implement choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing; the scenario instead requires use a private endpoint instead of a service endpoint for private-IP service access. The differentiating evidence is that the client resolves to a private endpoint IP and public service network access is disabled.

Service endpoint enablement alone does not grant access at the PaaS service network policy layer. However, the option would implement add the selected VNet/subnet to the target service's virtual network access rules; the scenario instead requires use a private endpoint instead of a service endpoint for private-IP service access. The differentiating evidence is that the client resolves to a private endpoint IP and public service network access is disabled.

Service endpoints are configured at subnet level, not automatically across an entire VNet. However, the option would implement enable the supported service endpoint on each specific subnet that requires the Azure service network identity; the scenario instead requires use a private endpoint instead of a service endpoint for private-IP service access. The differentiating evidence is that the client resolves to a private endpoint IP and public service network access is disabled.

WAF custom rate limits and bot controls can mitigate application-layer request floods when correctly scoped. However, the option would implement configure supported WAF rate-limit or bot protection rules at the appropriate edge scope; the scenario instead requires apply a narrowly scoped WAF exclusion or supported per-rule override instead of disabling all protection. The differentiating evidence is that the legitimate form succeeds and unrelated malicious-pattern test traffic remains blocked.

Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. However, the option would implement use WAF diagnostic logs to identify matched policy, rule and client/request details; the scenario instead requires apply a narrowly scoped WAF exclusion or supported per-rule override instead of disabling all protection. The differentiating evidence is that the legitimate form succeeds and unrelated malicious-pattern test traffic remains blocked.

Managed rule set versions can change match behavior and should be tested against legitimate traffic. However, the option would implement review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence; the scenario instead requires apply a narrowly scoped WAF exclusion or supported per-rule override instead of disabling all protection. The differentiating evidence is that the legitimate form succeeds and unrelated malicious-pattern test traffic remains blocked.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires create purpose-specific subnets in the VNet and apply matching network security and routing controls. The differentiating evidence is that test packets follow the correct subnet route and the intended allow or deny decision is recorded.

Connected peers and gateways must recognize updated prefixes and traffic cannot rely on stale addressing during migration. However, the option would implement plan address-space updates with peering synchronization and dependency validation before routing cutover; the scenario instead requires create purpose-specific subnets in the VNet and apply matching network security and routing controls. The differentiating evidence is that test packets follow the correct subnet route and the intended allow or deny decision is recorded.

Outbound connectivity does not require each backend NIC to carry a public address or accept inbound traffic. However, the option would implement use private backend addressing and implement egress separately through a controlled outbound path; the scenario instead requires create purpose-specific subnets in the VNet and apply matching network security and routing controls. The differentiating evidence is that test packets follow the correct subnet route and the intended allow or deny decision is recorded.

That observation would primarily validate another control: register eligible NIC IP configurations or supported resources in the load balancer backend pool. Load balancing applies only to members registered in its backend pool and passing health checks. The situation calls for evidence that an approved connection traverses the appliance and appears in inspection logs before reaching the backend.

That observation would primarily validate another control: configure appropriate Load Balancer probe and rollout health gating for backend readiness. Probe-driven backend health prevents new flows from being distributed to failing endpoints. The situation calls for evidence that an approved connection traverses the appliance and appears in inspection logs before reaching the backend.

That observation would primarily validate another control: configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules. High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. The situation calls for evidence that an approved connection traverses the appliance and appears in inspection logs before reaching the backend.

Front Door origin selection depends on health probes and configured origin priority or weight. However, the option would implement configure Front Door origin-group health probes and suitable priority or weight settings; the scenario instead requires complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. The differentiating evidence is that the hostname resolves to Front Door and an external client negotiates TLS with its correct certificate.

Front Door edge caching improves static content delivery only when caching policies respect dynamic or private data. However, the option would implement configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content; the scenario instead requires complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. The differentiating evidence is that the hostname resolves to Front Door and an external client negotiates TLS with its correct certificate.

Private Link origin connectivity requires accepted connection state and valid private endpoint/DNS behavior. However, the option would implement approve the required private endpoint connection and verify the origin's private link health; the scenario instead requires complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. The differentiating evidence is that the hostname resolves to Front Door and an external client negotiates TLS with its correct certificate.

Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. However, the option would implement create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers; the scenario instead requires link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path. The differentiating evidence is that an on-premises query through the inbound endpoint returns the expected zone record rather than NXDOMAIN.

Correct name resolution does not create connectivity; routing, firewall and endpoint access still matter. However, the option would implement validate DNS resolution separately from IP routing and provide an approved private network path; the scenario instead requires link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path. The differentiating evidence is that an on-premises query through the inbound endpoint returns the expected zone record rather than NXDOMAIN.

Forwarding to an inbound endpoint from a ruleset linked to that same resolver VNet can cause a DNS loop. However, the option would implement remove a self-referential forwarding ruleset link or rule to prevent a resolver forwarding loop; the scenario instead requires link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path. The differentiating evidence is that an on-premises query through the inbound endpoint returns the expected zone record rather than NXDOMAIN.

IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. However, the option would implement align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN; the scenario instead requires configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints. The differentiating evidence is that a controlled single-tunnel interruption leaves the alternate tunnel carrying authorized network traffic.

A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. However, the option would implement deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device; the scenario instead requires configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints. The differentiating evidence is that a controlled single-tunnel interruption leaves the alternate tunnel carrying authorized network traffic.

Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. However, the option would implement update the local network gateway resource with the remote VPN device public IP and correct prefixes; the scenario instead requires configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints. The differentiating evidence is that a controlled single-tunnel interruption leaves the alternate tunnel carrying authorized network traffic.

A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. However, the option would implement respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists; the scenario instead requires use Azure Virtual Network Manager connectivity configurations and appropriate network groups. The differentiating evidence is that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. However, the option would implement inspect the effective-route longest-prefix match and add the proper more-specific route where supported; the scenario instead requires use Azure Virtual Network Manager connectivity configurations and appropriate network groups. The differentiating evidence is that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

Control-plane connectivity and data-plane path selection must be diagnosed separately. However, the option would implement inspect peering status, route propagation and effective routes before changing security policies; the scenario instead requires use Azure Virtual Network Manager connectivity configurations and appropriate network groups. The differentiating evidence is that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

Virtual hubs need relevant gateways to terminate the actual connection type. However, the option would implement deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings; the scenario instead requires configure route propagation from the branch connection into the spoke's associated route table. The differentiating evidence is that the spoke effective routes show required branch prefixes and approved application tests pass.

Virtual WAN hub interconnect and route propagation control cross-region VNet path availability. However, the option would implement check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions; the scenario instead requires configure route propagation from the branch connection into the spoke's associated route table. The differentiating evidence is that the spoke effective routes show required branch prefixes and approved application tests pass.

Virtual WAN Standard supports centralized hub routing and expanded branch/VNet connectivity services. However, the option would implement deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections; the scenario instead requires configure route propagation from the branch connection into the spoke's associated route table. The differentiating evidence is that the spoke effective routes show required branch prefixes and approved application tests pass.