That observation would primarily validate another control: apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. NSGs filter packet tuples at subnet or NIC scope and can restrict access by source, destination, port and protocol. The situation calls for evidence that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

That observation would primarily validate another control: inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. The situation calls for evidence that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

That observation would primarily validate another control: match NSG rules to the effective private source and destination packet addresses at the NIC boundary. NSG policy evaluation sees packet addresses at its network scope rather than assuming Internet NAT addresses. The situation calls for evidence that approved endpoint traffic succeeds while representative disallowed traffic matches the expected deny.

That observation would primarily validate another control: revoke or deny the specific P2S client certificate by supported gateway configuration and policy. Certificate trust must be able to exclude compromised or retired client certificates. The situation calls for evidence that a managed device establishes the expected VPN under approved triggers without manual profile entry.

That observation would primarily validate another control: configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets. RADIUS authentication depends on an accessible server and consistent protocol/authentication configuration. The situation calls for evidence that a managed device establishes the expected VPN under approved triggers without manual profile entry.

That observation would primarily validate another control: constrain client routing and enforce destination access with NSGs and identity-aware controls. P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. The situation calls for evidence that a managed device establishes the expected VPN under approved triggers without manual profile entry.

Private endpoints can serve on-premises clients when DNS and private routing to the VNet are established. However, the option would implement route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS; the scenario instead requires restrict or disable the PaaS resource's public network access separately from creating its private endpoint. The differentiating evidence is that an external unauthorized public connection fails while the approved private client connects.

Connection approval separates consumer endpoint provisioning from provider authorization. However, the option would implement require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers; the scenario instead requires restrict or disable the PaaS resource's public network access separately from creating its private endpoint. The differentiating evidence is that an external unauthorized public connection fails while the approved private client connects.

Private endpoint connectivity depends on the destination service's supported private link capabilities. However, the option would implement check resource-specific Private Link support, subresource group IDs and regional availability before implementation; the scenario instead requires restrict or disable the PaaS resource's public network access separately from creating its private endpoint. The differentiating evidence is that an external unauthorized public connection fails while the approved private client connects.

Secured virtual hubs support managed firewall enforcement for connected traffic when routing is configured. However, the option would implement deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy; the scenario instead requires create an Azure Firewall application rule scoped to the required FQDN and protocol. The differentiating evidence is that the approved hostname works while an unrelated HTTPS hostname is denied and logged.

NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. However, the option would implement combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth; the scenario instead requires create an Azure Firewall application rule scoped to the required FQDN and protocol. The differentiating evidence is that the approved hostname works while an unrelated HTTPS hostname is denied and logged.

Advanced IDPS and TLS inspection are Premium capabilities and require certificate and policy planning. However, the option would implement select Azure Firewall Premium and configure supported TLS inspection and IDPS settings; the scenario instead requires create an Azure Firewall application rule scoped to the required FQDN and protocol. The differentiating evidence is that the approved hostname works while an unrelated HTTPS hostname is denied and logged.

Certificate trust must be able to exclude compromised or retired client certificates. However, the option would implement revoke or deny the specific P2S client certificate by supported gateway configuration and policy; the scenario instead requires assign a distinct nonoverlapping P2S client address pool and republish the client configuration. The differentiating evidence is that connected clients receive valid pool addresses and their routes reach the targeted Azure private resources.

Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. However, the option would implement select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication; the scenario instead requires assign a distinct nonoverlapping P2S client address pool and republish the client configuration. The differentiating evidence is that connected clients receive valid pool addresses and their routes reach the targeted Azure private resources.

P2S gateway SKU limits and client tunnel health are distinct from account credential validity. However, the option would implement inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls; the scenario instead requires assign a distinct nonoverlapping P2S client address pool and republish the client configuration. The differentiating evidence is that connected clients receive valid pool addresses and their routes reach the targeted Azure private resources.

Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. However, the option would implement configure P2S root certificate trust and issue valid client certificates from the approved CA; the scenario instead requires regenerate and distribute the appropriate Azure VPN client configuration profile after gateway changes. The differentiating evidence is that a freshly configured client imports the new profile and reaches the expected VNet resources.

Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. However, the option would implement assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment; the scenario instead requires regenerate and distribute the appropriate Azure VPN client configuration profile after gateway changes. The differentiating evidence is that a freshly configured client imports the new profile and reaches the expected VNet resources.

RADIUS authentication depends on an accessible server and consistent protocol/authentication configuration. However, the option would implement configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets; the scenario instead requires regenerate and distribute the appropriate Azure VPN client configuration profile after gateway changes. The differentiating evidence is that a freshly configured client imports the new profile and reaches the expected VNet resources.

That observation would primarily validate another control: assign a distinct nonoverlapping P2S client address pool and republish the client configuration. Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. The situation calls for evidence that the client route table includes intended branch prefixes and an approved test port works end-to-end.

That observation would primarily validate another control: choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. P2S tunnel protocol support varies by gateway settings and VPN client platform. The situation calls for evidence that the client route table includes intended branch prefixes and an approved test port works end-to-end.

That observation would primarily validate another control: constrain client routing and enforce destination access with NSGs and identity-aware controls. P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. The situation calls for evidence that the client route table includes intended branch prefixes and an approved test port works end-to-end.

Virtual WAN supports user VPN gateways for individually authenticated client connectivity. However, the option would implement deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration; the scenario instead requires select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features. The differentiating evidence is that the intended gateway and secured-hub features can be provisioned and expected connections establish.

Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. However, the option would implement deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies; the scenario instead requires select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features. The differentiating evidence is that the intended gateway and secured-hub features can be provisioned and expected connections establish.

Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. However, the option would implement use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation; the scenario instead requires select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features. The differentiating evidence is that the intended gateway and secured-hub features can be provisioned and expected connections establish.

Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. However, the option would implement create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route; the scenario instead requires use Azure Virtual Network Manager security admin configurations within supported scope. The differentiating evidence is that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

New NSG flow logs are no longer supported; VNet flow logs are the recommended replacement. However, the option would implement enable VNet flow logs and export to supported monitoring rather than attempting a new NSG flow-log deployment; the scenario instead requires use Azure Virtual Network Manager security admin configurations within supported scope. The differentiating evidence is that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. However, the option would implement inspect effective security rules and IP flow verify for the exact source, destination, protocol and port; the scenario instead requires use Azure Virtual Network Manager security admin configurations within supported scope. The differentiating evidence is that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

Global Reach connects supported on-premises networks through eligible ExpressRoute circuit relationships. However, the option would implement use ExpressRoute Global Reach between eligible circuits and confirm support across their locations; the scenario instead requires match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters. The differentiating evidence is that the BGP session reaches established state and correct advertised routes are visible.

Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. However, the option would implement configure Microsoft peering only for eligible services and with the required prefix authorization and route filters; the scenario instead requires match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters. The differentiating evidence is that the BGP session reaches established state and correct advertised routes are visible.

FastPath can improve the data path for supported ExpressRoute configurations by bypassing the gateway dataplane. However, the option would implement enable ExpressRoute FastPath on compatible circuits, gateways and network resources; the scenario instead requires match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters. The differentiating evidence is that the BGP session reaches established state and correct advertised routes are visible.

That observation would primarily validate another control: create an internal Azure Load Balancer with a private frontend and eligible backend pool. Azure Load Balancer distributes layer-4 traffic to backend endpoints while an internal frontend stays private. The situation calls for evidence that both registered healthy instances receive requests under an observed distribution sample.

That observation would primarily validate another control: adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. The situation calls for evidence that both registered healthy instances receive requests under an observed distribution sample.

That observation would primarily validate another control: configure appropriate Load Balancer probe and rollout health gating for backend readiness. Probe-driven backend health prevents new flows from being distributed to failing endpoints. The situation calls for evidence that both registered healthy instances receive requests under an observed distribution sample.