User-defined routes direct selected prefixes through a network virtual appliance when transparent inspection is required. However, the option would implement associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop; the scenario instead requires validate symmetric request and return routes through the stateful inspection appliance. The differentiating evidence is that packet captures on both sides show request and response traversing the expected inspection point.

Subnet NAT Gateway supplies outbound-only address translation without creating VM public listeners. However, the option would implement place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs; the scenario instead requires validate symmetric request and return routes through the stateful inspection appliance. The differentiating evidence is that packet captures on both sides show request and response traversing the expected inspection point.

Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. However, the option would implement configure hub gateway transit and enable use of remote gateways on the eligible spoke peering; the scenario instead requires validate symmetric request and return routes through the stateful inspection appliance. The differentiating evidence is that packet captures on both sides show request and response traversing the expected inspection point.

Azure Firewall policy evaluation order and processing rules determine which matching decision applies. However, the option would implement review Firewall Policy rule-collection-group and collection processing order and correct priorities; the scenario instead requires configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination. The differentiating evidence is that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

Azure Firewall provisioning requires its reserved subnet and adequate address capacity. However, the option would implement reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants; the scenario instead requires configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination. The differentiating evidence is that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

Hierarchical policies provide centralized baselines while allowing controlled local additions. However, the option would implement use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies; the scenario instead requires configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination. The differentiating evidence is that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

That observation would primarily validate another control: check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies. Both subnet and NIC security groups participate in evaluating traffic, so one permissive rule is insufficient. The situation calls for evidence that a controlled source-address test is denied while permitted client ranges remain reachable.

That observation would primarily validate another control: configure supported private endpoint network-policy settings and relevant NSG rules where enabled. Private endpoint NSG and UDR enforcement depends on subnet network policy configuration. The situation calls for evidence that a controlled source-address test is denied while permitted client ranges remain reachable.

That observation would primarily validate another control: apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. NSGs filter packet tuples at subnet or NIC scope and can restrict access by source, destination, port and protocol. The situation calls for evidence that a controlled source-address test is denied while permitted client ranges remain reachable.

Forced tunneling through an appliance requires an explicit default route from the workload subnet. However, the option would implement apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop; the scenario instead requires respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. The differentiating evidence is that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

Centralized change definitions make route and topology deviations detectable before deployment. However, the option would implement deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations; the scenario instead requires respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. The differentiating evidence is that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

UDRs affect only subnets to which their route table is associated. However, the option would implement associate the intended route table with every subnet that must use that UDR policy; the scenario instead requires respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. The differentiating evidence is that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

NSGs enforce network transport rules and do not parse application attack payloads. However, the option would implement deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters; the scenario instead requires define WAF custom geographic match rules or supported edge access controls for the target domains. The differentiating evidence is that a permitted-region test succeeds and a restricted-region test follows the configured deny response.

WAF policies inspect HTTP application requests for known attack patterns rather than replacing NSG port controls. However, the option would implement attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode; the scenario instead requires define WAF custom geographic match rules or supported edge access controls for the target domains. The differentiating evidence is that a permitted-region test succeeds and a restricted-region test follows the configured deny response.

Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. However, the option would implement use WAF diagnostic logs to identify matched policy, rule and client/request details; the scenario instead requires define WAF custom geographic match rules or supported edge access controls for the target domains. The differentiating evidence is that a permitted-region test succeeds and a restricted-region test follows the configured deny response.

Cloud exchange, point-to-point and other provider models have different operational and physical requirements. However, the option would implement choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning; the scenario instead requires provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. The differentiating evidence is that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. However, the option would implement design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections; the scenario instead requires provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. The differentiating evidence is that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

ExpressRoute reachability depends on the prefixes exchanged through established peering sessions. However, the option would implement correct BGP route advertisements and filters so the desired prefixes propagate in both directions; the scenario instead requires provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. The differentiating evidence is that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

That observation would primarily validate another control: allocate a Public IP Prefix and create supported public IP resources from that prefix. Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. The situation calls for evidence that an authorized administrator opens an RDP or SSH session to a private VM without assigning it a public IP.

That observation would primarily validate another control: provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall. Azure Firewall uses a specific reserved subnet name and supported minimum capacity for deployment and scaling. The situation calls for evidence that an authorized administrator opens an RDP or SSH session to a private VM without assigning it a public IP.

That observation would primarily validate another control: allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity. Peering and hybrid routing require unambiguous destinations; overlapping prefixes prevent intended reachability. The situation calls for evidence that an authorized administrator opens an RDP or SSH session to a private VM without assigning it a public IP.

That observation would primarily validate another control: align Application Gateway backend host-name and health-probe configuration with the origin virtual host. Layer-7 backend routing and TLS validation depend on the host and protocol settings. The situation calls for evidence that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

That observation would primarily validate another control: attach a supported Application Gateway WAF policy in the intended enforcement mode. Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. The situation calls for evidence that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

That observation would primarily validate another control: configure an Application Gateway redirect configuration associated with the right listener or rule. HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. The situation calls for evidence that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

That observation would primarily validate another control: configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. Outbound endpoints and forwarding rules let Azure-resident clients resolve selected external DNS namespaces. The situation calls for evidence that a query to public recursive resolvers returns the delegated Azure DNS answer for the test hostname.

That observation would primarily validate another control: reduce record TTL before a planned migration and validate propagation and client cache expiry. DNS caching can delay a record change independently of network route availability. The situation calls for evidence that a query to public recursive resolvers returns the delegated Azure DNS answer for the test hostname.

That observation would primarily validate another control: apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. DNS-layer policy can block known malicious domains without treating an IP firewall allow rule as DNS security. The situation calls for evidence that a query to public recursive resolvers returns the delegated Azure DNS answer for the test hostname.

That observation would primarily validate another control: add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. The situation calls for evidence that a client requesting the old path receives the correct redirect status and destination URL.

That observation would primarily validate another control: configure appropriate multi-site listeners and host-based routing rules on Application Gateway. Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. The situation calls for evidence that a client requesting the old path receives the correct redirect status and destination URL.

That observation would primarily validate another control: replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. The situation calls for evidence that a client requesting the old path receives the correct redirect status and destination URL.

That observation would primarily validate another control: apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. NSGs filter packet tuples at subnet or NIC scope and can restrict access by source, destination, port and protocol. The situation calls for evidence that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

That observation would primarily validate another control: inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. The situation calls for evidence that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

That observation would primarily validate another control: match NSG rules to the effective private source and destination packet addresses at the NIC boundary. NSG policy evaluation sees packet addresses at its network scope rather than assuming Internet NAT addresses. The situation calls for evidence that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.