Virtual hubs need relevant gateways to terminate the actual connection type. However, the option would implement deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings; the scenario instead requires configure route propagation from the branch connection into the spoke's associated route table. The differentiating evidence is that the spoke effective routes show required branch prefixes and approved application tests pass.

Virtual WAN hub interconnect and route propagation control cross-region VNet path availability. However, the option would implement check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions; the scenario instead requires configure route propagation from the branch connection into the spoke's associated route table. The differentiating evidence is that the spoke effective routes show required branch prefixes and approved application tests pass.

Virtual WAN Standard supports centralized hub routing and expanded branch/VNet connectivity services. However, the option would implement deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections; the scenario instead requires configure route propagation from the branch connection into the spoke's associated route table. The differentiating evidence is that the spoke effective routes show required branch prefixes and approved application tests pass.

IP-prefix and application security group membership determine which NSG rules match relocated workloads. However, the option would implement update NSG source or ASG membership for the new workload placement after validating its identity; the scenario instead requires configure supported private endpoint network-policy settings and relevant NSG rules where enabled. The differentiating evidence is that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

Both subnet and NIC security groups participate in evaluating traffic, so one permissive rule is insufficient. However, the option would implement check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies; the scenario instead requires configure supported private endpoint network-policy settings and relevant NSG rules where enabled. The differentiating evidence is that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. However, the option would implement store NSG configurations in versioned IaC and validate effective rules before and after deployment; the scenario instead requires configure supported private endpoint network-policy settings and relevant NSG rules where enabled. The differentiating evidence is that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. However, the option would implement update local network gateway address spaces or validated BGP advertisements for the missing prefix; the scenario instead requires select a supported VPN gateway SKU meeting tunnel counts, throughput, BGP and resiliency requirements. The differentiating evidence is that gateway metrics under a representative load remain within capacity and redundant branch paths stay connected.

Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. However, the option would implement choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed; the scenario instead requires select a supported VPN gateway SKU meeting tunnel counts, throughput, BGP and resiliency requirements. The differentiating evidence is that gateway metrics under a representative load remain within capacity and redundant branch paths stay connected.

Internet-bound branch traffic requires explicit default-route propagation and a compatible secured hub path. However, the option would implement design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing; the scenario instead requires select a supported VPN gateway SKU meeting tunnel counts, throughput, BGP and resiliency requirements. The differentiating evidence is that gateway metrics under a representative load remain within capacity and redundant branch paths stay connected.

Prevention mode can block matching HTTP requests, while detection mode is nonblocking. However, the option would implement change the tuned WAF policy to prevention mode and confirm the intended managed rule action; the scenario instead requires attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode. The differentiating evidence is that an approved safe injection test produces a managed rule match while ordinary requests remain available.

Broad WAF exclusions create avoidable blind spots while a targeted exception can preserve other detection coverage. However, the option would implement limit WAF exclusions to the smallest required match variable, field or rule; the scenario instead requires attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode. The differentiating evidence is that an approved safe injection test produces a managed rule match while ordinary requests remain available.

Front Door WAF applies application-layer filtering at the Microsoft edge for protected routes. However, the option would implement associate a Front Door WAF policy with the intended endpoint domains through a security policy; the scenario instead requires attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode. The differentiating evidence is that an approved safe injection test produces a managed rule match while ordinary requests remain available.

Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. However, the option would implement configure appropriate multi-site listeners and host-based routing rules on Application Gateway; the scenario instead requires configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway. The differentiating evidence is that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

Layer-7 backend routing and TLS validation depend on the host and protocol settings. However, the option would implement align Application Gateway backend host-name and health-probe configuration with the origin virtual host; the scenario instead requires configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway. The differentiating evidence is that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

Frontend TLS termination does not automatically encrypt the independent gateway-to-backend connection. However, the option would implement configure HTTPS backend settings with suitable server certificate trust and host-name handling; the scenario instead requires configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway. The differentiating evidence is that an HTTP test receives the specified redirect and the resulting HTTPS response has a valid certificate.

That observation would primarily validate another control: link the correct service-specific private DNS zone to the client VNet and verify A-record resolution. Private Link endpoint creation does not guarantee client DNS queries return the private IP. The situation calls for evidence that test clients in every approved spoke resolve the correct endpoint IPs.

That observation would primarily validate another control: approve the intended private endpoint connection on the target resource before testing access. Some Private Link connections require resource-owner approval before private traffic is accepted. The situation calls for evidence that test clients in every approved spoke resolve the correct endpoint IPs.

That observation would primarily validate another control: create the needed private endpoints and matching DNS zones for each required supported storage subresource. Private Link for multi-service resources may have different endpoint group IDs and DNS zones. The situation calls for evidence that test clients in every approved spoke resolve the correct endpoint IPs.

Priority and network scope determine whether an explicit source-block rule matches before broad allows. However, the option would implement create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points; the scenario instead requires use Network Watcher connection testing and IP flow verify alongside service listener checks. The differentiating evidence is that the failing flow is attributed to a specific NSG decision or listener issue and the correct fix is confirmed.

Direct Internet-wide RDP exposure is unnecessary when managed private administration is available. However, the option would implement use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress; the scenario instead requires use Network Watcher connection testing and IP flow verify alongside service listener checks. The differentiating evidence is that the failing flow is attributed to a specific NSG decision or listener issue and the correct fix is confirmed.

ASGs identify groups of NICs for rule targets without hard-coding changing workload IPs. However, the option would implement create an application security group and reference it in supported NSG rules for member network interfaces; the scenario instead requires use Network Watcher connection testing and IP flow verify alongside service listener checks. The differentiating evidence is that the failing flow is attributed to a specific NSG decision or listener issue and the correct fix is confirmed.

Targeted tuning preserves the broader managed rule set while addressing a justified false positive. However, the option would implement apply a narrowly scoped WAF exclusion or supported per-rule override instead of disabling all protection; the scenario instead requires attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode. The differentiating evidence is that an approved safe injection test produces a managed rule match while ordinary requests remain available.

NSGs enforce network transport rules and do not parse application attack payloads. However, the option would implement deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters; the scenario instead requires attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode. The differentiating evidence is that an approved safe injection test produces a managed rule match while ordinary requests remain available.

Geographic filtering requires explicit request-based policy and should not be confused with backend origin placement. However, the option would implement define WAF custom geographic match rules or supported edge access controls for the target domains; the scenario instead requires attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode. The differentiating evidence is that an approved safe injection test produces a managed rule match while ordinary requests remain available.

That observation would primarily validate another control: configure supported internal and public frontend IP configurations and bind listeners to the intended frontend. Frontend IP and listener bindings determine which network scope can reach each Application Gateway site. The situation calls for evidence that an /api request and an unrelated path are served by the expected separate pools.

That observation would primarily validate another control: add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. The situation calls for evidence that an /api request and an unrelated path are served by the expected separate pools.

That observation would primarily validate another control: replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. The situation calls for evidence that an /api request and an unrelated path are served by the expected separate pools.

That observation would primarily validate another control: use Azure Virtual Network Manager security admin configurations within supported scope. Security admin rules can centrally enforce network intent across managed VNet groups. The situation calls for evidence that a test east-west flow produces the expected VNet flow record in the selected log destination.

That observation would primarily validate another control: store NSG configurations in versioned IaC and validate effective rules before and after deployment. Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. The situation calls for evidence that a test east-west flow produces the expected VNet flow record in the selected log destination.

That observation would primarily validate another control: create an application security group and reference it in supported NSG rules for member network interfaces. ASGs identify groups of NICs for rule targets without hard-coding changing workload IPs. The situation calls for evidence that a test east-west flow produces the expected VNet flow record in the selected log destination.

That observation would primarily validate another control: configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. The situation calls for evidence that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

That observation would primarily validate another control: renumber overlapping VNet address spaces before peering or design a supported translation boundary. Direct VNet peering does not resolve overlapping address-space ambiguity. The situation calls for evidence that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.