That observation would primarily validate another control: configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. The situation calls for evidence that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

That observation would primarily validate another control: renumber overlapping VNet address spaces before peering or design a supported translation boundary. Direct VNet peering does not resolve overlapping address-space ambiguity. The situation calls for evidence that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

That observation would primarily validate another control: inspect peering status, route propagation and effective routes before changing security policies. Control-plane connectivity and data-plane path selection must be diagnosed separately. The situation calls for evidence that the destination prefixes no longer overlap and peering establishes without address collision errors.

That observation would primarily validate another control: associate the intended route table with every subnet that must use that UDR policy. UDRs affect only subnets to which their route table is associated. The situation calls for evidence that the destination prefixes no longer overlap and peering establishes without address collision errors.

That observation would primarily validate another control: compare effective routes and correct the conflicting UDR or route-propagation setting. A working BGP control plane does not guarantee the desired next hop when route tables override propagated paths. The situation calls for evidence that the destination prefixes no longer overlap and peering establishes without address collision errors.

That observation would primarily validate another control: use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. The situation calls for evidence that requests with each route pattern reach the intended origin while unmatched patterns follow the designed default.

That observation would primarily validate another control: apply supported origin access restrictions using Front Door identification and approved security controls. Public origins need defenses against clients bypassing edge WAF and delivery rules. The situation calls for evidence that requests with each route pattern reach the intended origin while unmatched patterns follow the designed default.

That observation would primarily validate another control: approve the required private endpoint connection and verify the origin's private link health. Private Link origin connectivity requires accepted connection state and valid private endpoint/DNS behavior. The situation calls for evidence that requests with each route pattern reach the intended origin while unmatched patterns follow the designed default.

That observation would primarily validate another control: check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies. Both subnet and NIC security groups participate in evaluating traffic, so one permissive rule is insufficient. The situation calls for evidence that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

That observation would primarily validate another control: associate the NSG with the actual target subnet or network interface and validate effective policy. An unattached NSG does not evaluate workload traffic merely because its resource exists. The situation calls for evidence that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

That observation would primarily validate another control: create an application security group and reference it in supported NSG rules for member network interfaces. ASGs identify groups of NICs for rule targets without hard-coding changing workload IPs. The situation calls for evidence that the approved patch path succeeds and a prohibited outbound destination is denied in flow testing.

ExpressRoute reachability depends on the prefixes exchanged through established peering sessions. However, the option would implement correct BGP route advertisements and filters so the desired prefixes propagate in both directions; the scenario instead requires select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. The differentiating evidence is that the two target regions can attach through the designed service and verify permitted test traffic.

ExpressRoute Direct offers dedicated port pairs for creating supported ExpressRoute circuits at high scale. However, the option would implement evaluate ExpressRoute Direct and its dedicated port and peering-location requirements; the scenario instead requires select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. The differentiating evidence is that the two target regions can attach through the designed service and verify permitted test traffic.

Private peering is a BGP arrangement and cannot establish with inconsistent peer identifiers or IP addressing. However, the option would implement match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters; the scenario instead requires select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. The differentiating evidence is that the two target regions can attach through the designed service and verify permitted test traffic.

P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. However, the option would implement constrain client routing and enforce destination access with NSGs and identity-aware controls; the scenario instead requires review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes. The differentiating evidence is that the client route table includes intended branch prefixes and an approved test port works end-to-end.

Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. However, the option would implement select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication; the scenario instead requires review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes. The differentiating evidence is that the client route table includes intended branch prefixes and an approved test port works end-to-end.

Always On VPN is a client-side management design with specific tunnel and infrastructure requirements. However, the option would implement validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration; the scenario instead requires review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes. The differentiating evidence is that the client route table includes intended branch prefixes and an approved test port works end-to-end.

That observation would primarily validate another control: add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. The situation calls for evidence that updated effective routes reflect the new prefixes and representative traffic works before old addresses are removed.

That observation would primarily validate another control: use private backend addressing and implement egress separately through a controlled outbound path. Outbound connectivity does not require each backend NIC to carry a public address or accept inbound traffic. The situation calls for evidence that updated effective routes reflect the new prefixes and representative traffic works before old addresses are removed.

That observation would primarily validate another control: create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. The situation calls for evidence that updated effective routes reflect the new prefixes and representative traffic works before old addresses are removed.

Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. However, the option would implement configure P2S root certificate trust and issue valid client certificates from the approved CA; the scenario instead requires assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. The differentiating evidence is that the supported Windows host establishes the expected private management path to the target VM.

Client settings must match the endpoint, routes and auth mode configured on the gateway. However, the option would implement regenerate and distribute the appropriate Azure VPN client configuration profile after gateway changes; the scenario instead requires assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. The differentiating evidence is that the supported Windows host establishes the expected private management path to the target VM.

P2S connection establishes reachability but private DNS lookup depends on client and gateway DNS settings. However, the option would implement provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration; the scenario instead requires assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. The differentiating evidence is that the supported Windows host establishes the expected private management path to the target VM.

That observation would primarily validate another control: design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections. Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. The situation calls for evidence that bGP advertises the expected authorized Microsoft-service prefixes without exposing unintended routes.

That observation would primarily validate another control: deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit. An ExpressRoute circuit alone is not a VNet-to-circuit connection without the gateway or supported architecture. The situation calls for evidence that bGP advertises the expected authorized Microsoft-service prefixes without exposing unintended routes.

That observation would primarily validate another control: provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. ExpressRoute provides private connectivity through a provider path, subject to service and circuit design. The situation calls for evidence that bGP advertises the expected authorized Microsoft-service prefixes without exposing unintended routes.

NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. However, the option would implement attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet; the scenario instead requires compare effective routes and correct the conflicting UDR or route-propagation setting. The differentiating evidence is that the corrected NIC effective route points to the approved gateway and the application test succeeds.

VNet peering is not intrinsically transitive; a route or gateway strategy is required for spoke-to-spoke transit. However, the option would implement design an explicit routed transit path using an NVA or supported hub routing architecture; the scenario instead requires compare effective routes and correct the conflicting UDR or route-propagation setting. The differentiating evidence is that the corrected NIC effective route points to the approved gateway and the application test succeeds.

Control-plane connectivity and data-plane path selection must be diagnosed separately. However, the option would implement inspect peering status, route propagation and effective routes before changing security policies; the scenario instead requires compare effective routes and correct the conflicting UDR or route-propagation setting. The differentiating evidence is that the corrected NIC effective route points to the approved gateway and the application test succeeds.

Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. However, the option would implement configure Microsoft peering only for eligible services and with the required prefix authorization and route filters; the scenario instead requires use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. The differentiating evidence is that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

A private transport path is not inherently end-to-end payload encryption for compliance purposes. However, the option would implement add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate; the scenario instead requires use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. The differentiating evidence is that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.

ExpressRoute provides private connectivity through a provider path, subject to service and circuit design. However, the option would implement provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering; the scenario instead requires use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. The differentiating evidence is that a controlled peer-link interruption is detected within the target interval and an alternate route becomes active.