ASGs identify groups of NICs for rule targets without hard-coding changing workload IPs. However, the option would implement create an application security group and reference it in supported NSG rules for member network interfaces; the scenario instead requires check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies. The differentiating evidence is that the effective rule analysis identifies the controlling deny and the permitted test passes after approved changes.

Security admin rules can centrally enforce network intent across managed VNet groups. However, the option would implement use Azure Virtual Network Manager security admin configurations within supported scope; the scenario instead requires check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies. The differentiating evidence is that the effective rule analysis identifies the controlling deny and the permitted test passes after approved changes.

Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. However, the option would implement create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route; the scenario instead requires check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies. The differentiating evidence is that the effective rule analysis identifies the controlling deny and the permitted test passes after approved changes.

That observation would primarily validate another control: use Network Watcher connectivity testing and route diagnostics from a representative Azure source. Healthy connection resources do not prove application reachability across security and routing boundaries. The situation calls for evidence that the tool reports the matching rule and an authorized test follows the expected action after remediation.

That observation would primarily validate another control: review Defender for Cloud Secure Score security recommendations for network resources. Secure Score recommendations expose actionable posture findings to prioritize weak network configurations. The situation calls for evidence that the tool reports the matching rule and an authorized test follows the expected action after remediation.

That observation would primarily validate another control: enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs. DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. The situation calls for evidence that the tool reports the matching rule and an authorized test follows the expected action after remediation.

Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. However, the option would implement choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed; the scenario instead requires resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S. The differentiating evidence is that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. However, the option would implement deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device; the scenario instead requires resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S. The differentiating evidence is that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. However, the option would implement update local network gateway address spaces or validated BGP advertisements for the missing prefix; the scenario instead requires resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S. The differentiating evidence is that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. However, the option would implement use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance; the scenario instead requires deploy Azure Firewall into a supported hub and route workload egress through its private IP. The differentiating evidence is that a permitted destination is reachable and an unauthorized FQDN is blocked with an identifiable firewall log.

Central inspection is effective only if the policy meaningfully restricts destination and transport access. However, the option would implement replace blanket allows with least-privilege application and network rule collections; the scenario instead requires deploy Azure Firewall into a supported hub and route workload egress through its private IP. The differentiating evidence is that a permitted destination is reachable and an unauthorized FQDN is blocked with an identifiable firewall log.

Basic, Standard and Premium tiers have different security capabilities and capacity. However, the option would implement choose an appropriate Azure Firewall SKU based on needed feature set, throughput and cost; the scenario instead requires deploy Azure Firewall into a supported hub and route workload egress through its private IP. The differentiating evidence is that a permitted destination is reachable and an unauthorized FQDN is blocked with an identifiable firewall log.

Virtual WAN supports specific managed NVA integrations and partner deployment requirements. However, the option would implement use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model; the scenario instead requires choose the appropriate Virtual WAN hub gateway scale units and capacity parameters. The differentiating evidence is that measured throughput and concurrent connection counts remain within capacity under representative load.

Virtual hub routing depends on the association and propagation configuration of each connection. However, the option would implement correct Virtual WAN route table associations and propagation labels for the connected networks; the scenario instead requires choose the appropriate Virtual WAN hub gateway scale units and capacity parameters. The differentiating evidence is that measured throughput and concurrent connection counts remain within capacity under representative load.

Virtual hub route-table propagation determines which connection prefixes are visible to each subscriber. However, the option would implement configure route propagation from the branch connection into the spoke's associated route table; the scenario instead requires choose the appropriate Virtual WAN hub gateway scale units and capacity parameters. The differentiating evidence is that measured throughput and concurrent connection counts remain within capacity under representative load.

That observation would primarily validate another control: correct BGP route advertisements and filters so the desired prefixes propagate in both directions. ExpressRoute reachability depends on the prefixes exchanged through established peering sessions. The situation calls for evidence that the VNet connection reports success and an app reaches its private on-premises destination.

That observation would primarily validate another control: provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. ExpressRoute provides private connectivity through a provider path, subject to service and circuit design. The situation calls for evidence that the VNet connection reports success and an app reaches its private on-premises destination.

That observation would primarily validate another control: design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections. Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. The situation calls for evidence that the VNet connection reports success and an app reaches its private on-premises destination.

Private endpoints do not necessarily disable a service's existing public network endpoint automatically. However, the option would implement restrict or disable the PaaS resource's public network access separately from creating its private endpoint; the scenario instead requires provide separate approved private endpoints for each consumer to the shared eligible Private Link service. The differentiating evidence is that each consumer connects through its assigned local private address without overlapping network route conflicts.

Connection approval separates consumer endpoint provisioning from provider authorization. However, the option would implement require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers; the scenario instead requires provide separate approved private endpoints for each consumer to the shared eligible Private Link service. The differentiating evidence is that each consumer connects through its assigned local private address without overlapping network route conflicts.

Some Private Link connections require resource-owner approval before private traffic is accepted. However, the option would implement approve the intended private endpoint connection on the target resource before testing access; the scenario instead requires provide separate approved private endpoints for each consumer to the shared eligible Private Link service. The differentiating evidence is that each consumer connects through its assigned local private address without overlapping network route conflicts.

IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. However, the option would implement add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends; the scenario instead requires use private backend addressing and implement egress separately through a controlled outbound path. The differentiating evidence is that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. However, the option would implement provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway; the scenario instead requires use private backend addressing and implement egress separately through a controlled outbound path. The differentiating evidence is that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. However, the option would implement reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility; the scenario instead requires use private backend addressing and implement egress separately through a controlled outbound path. The differentiating evidence is that backend NICs have only private addresses while outbound test traffic uses the approved egress identity.

Virtual WAN gateway components are service-specific; S2S VPN gateway does not terminate ExpressRoute. However, the option would implement provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits; the scenario instead requires deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections. The differentiating evidence is that an authorized branch-to-spoke and hub-to-hub test follows the expected managed routing path.

Virtual hubs need relevant gateways to terminate the actual connection type. However, the option would implement deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings; the scenario instead requires deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections. The differentiating evidence is that an authorized branch-to-spoke and hub-to-hub test follows the expected managed routing path.

Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. However, the option would implement deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies; the scenario instead requires deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections. The differentiating evidence is that an authorized branch-to-spoke and hub-to-hub test follows the expected managed routing path.

Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. However, the option would implement define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements; the scenario instead requires renumber overlapping VNet address spaces before peering or design a supported translation boundary. The differentiating evidence is that the destination prefixes no longer overlap and peering establishes without address collision errors.

Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. However, the option would implement configure hub gateway transit and enable use of remote gateways on the eligible spoke peering; the scenario instead requires renumber overlapping VNet address spaces before peering or design a supported translation boundary. The differentiating evidence is that the destination prefixes no longer overlap and peering establishes without address collision errors.

Centralized change definitions make route and topology deviations detectable before deployment. However, the option would implement deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations; the scenario instead requires renumber overlapping VNet address spaces before peering or design a supported translation boundary. The differentiating evidence is that the destination prefixes no longer overlap and peering establishes without address collision errors.

Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. However, the option would implement place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets; the scenario instead requires define address and segmentation standards in IaC with governance checks before production deployment. The differentiating evidence is that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. However, the option would implement use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources; the scenario instead requires define address and segmentation standards in IaC with governance checks before production deployment. The differentiating evidence is that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires define address and segmentation standards in IaC with governance checks before production deployment. The differentiating evidence is that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.