Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. However, the option would implement place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets; the scenario instead requires define address and segmentation standards in IaC with governance checks before production deployment. The differentiating evidence is that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. However, the option would implement use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources; the scenario instead requires define address and segmentation standards in IaC with governance checks before production deployment. The differentiating evidence is that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires define address and segmentation standards in IaC with governance checks before production deployment. The differentiating evidence is that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

That observation would primarily validate another control: constrain client routing and enforce destination access with NSGs and identity-aware controls. P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. The situation calls for evidence that the client route table includes intended branch prefixes and an approved test port works end-to-end.

That observation would primarily validate another control: assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. The situation calls for evidence that the client route table includes intended branch prefixes and an approved test port works end-to-end.

That observation would primarily validate another control: configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets. RADIUS authentication depends on an accessible server and consistent protocol/authentication configuration. The situation calls for evidence that the client route table includes intended branch prefixes and an approved test port works end-to-end.

Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. However, the option would implement assign a distinct nonoverlapping P2S client address pool and republish the client configuration; the scenario instead requires assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. The differentiating evidence is that the supported Windows host establishes the expected private management path to the target VM.

Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. However, the option would implement select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication; the scenario instead requires assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. The differentiating evidence is that the supported Windows host establishes the expected private management path to the target VM.

VPN authentication alone does not install all required routes to remote interconnected networks. However, the option would implement review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes; the scenario instead requires assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. The differentiating evidence is that the supported Windows host establishes the expected private management path to the target VM.

That observation would primarily validate another control: associate the intended route table with every subnet that must use that UDR policy. UDRs affect only subnets to which their route table is associated. The situation calls for evidence that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

That observation would primarily validate another control: deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. Centralized change definitions make route and topology deviations detectable before deployment. The situation calls for evidence that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

That observation would primarily validate another control: validate symmetric request and return routes through the stateful inspection appliance. Stateful firewalls need consistent bidirectional session visibility or supported asymmetric-flow handling. The situation calls for evidence that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

Control-plane connectivity and data-plane path selection must be diagnosed separately. However, the option would implement inspect peering status, route propagation and effective routes before changing security policies; the scenario instead requires renumber overlapping VNet address spaces before peering or design a supported translation boundary. The differentiating evidence is that the destination prefixes no longer overlap and peering establishes without address collision errors.

Centralized change definitions make route and topology deviations detectable before deployment. However, the option would implement deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations; the scenario instead requires renumber overlapping VNet address spaces before peering or design a supported translation boundary. The differentiating evidence is that the destination prefixes no longer overlap and peering establishes without address collision errors.

A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. However, the option would implement respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists; the scenario instead requires renumber overlapping VNet address spaces before peering or design a supported translation boundary. The differentiating evidence is that the destination prefixes no longer overlap and peering establishes without address collision errors.

Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. However, the option would implement design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections; the scenario instead requires enable ExpressRoute FastPath on compatible circuits, gateways and network resources. The differentiating evidence is that a supported traffic flow follows the optimized path and meets measured throughput requirements.

BFD can detect forwarding failures rapidly and inform BGP convergence where supported. However, the option would implement use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration; the scenario instead requires enable ExpressRoute FastPath on compatible circuits, gateways and network resources. The differentiating evidence is that a supported traffic flow follows the optimized path and meets measured throughput requirements.

An ExpressRoute circuit alone is not a VNet-to-circuit connection without the gateway or supported architecture. However, the option would implement deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit; the scenario instead requires enable ExpressRoute FastPath on compatible circuits, gateways and network resources. The differentiating evidence is that a supported traffic flow follows the optimized path and meets measured throughput requirements.

That observation would primarily validate another control: associate the required UDR and validate effective routes across every protected workload subnet. Azure Firewall cannot inspect flows that routing directs around its data path. The situation calls for evidence that the client and firewall resolve the intended destination consistently and matching traffic follows the expected rule.

That observation would primarily validate another control: deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy. Secured virtual hubs support managed firewall enforcement for connected traffic when routing is configured. The situation calls for evidence that the client and firewall resolve the intended destination consistently and matching traffic follows the expected rule.

That observation would primarily validate another control: combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth. NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. The situation calls for evidence that the client and firewall resolve the intended destination consistently and matching traffic follows the expected rule.

That observation would primarily validate another control: add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace. Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. The situation calls for evidence that a trace of a controlled lookup shows one resolution path without recursive forwarding or timeout.

That observation would primarily validate another control: configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. Outbound endpoints and forwarding rules let Azure-resident clients resolve selected external DNS namespaces. The situation calls for evidence that a trace of a controlled lookup shows one resolution path without recursive forwarding or timeout.

That observation would primarily validate another control: link the intended spoke VNet to the appropriate DNS forwarding ruleset. Ruleset links determine which VNets apply the conditional forwarding rules; peering alone is insufficient. The situation calls for evidence that a trace of a controlled lookup shows one resolution path without recursive forwarding or timeout.

Azure Firewall uses a specific reserved subnet name and supported minimum capacity for deployment and scaling. However, the option would implement provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall; the scenario instead requires allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity. The differentiating evidence is that the documented address plan has no overlap and effective routes deliver packets to the intended VNet or site.

Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. However, the option would implement provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway; the scenario instead requires allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity. The differentiating evidence is that the documented address plan has no overlap and effective routes deliver packets to the intended VNet or site.

Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. However, the option would implement create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet; the scenario instead requires allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity. The differentiating evidence is that the documented address plan has no overlap and effective routes deliver packets to the intended VNet or site.

WAF policies inspect HTTP application requests for known attack patterns rather than replacing NSG port controls. However, the option would implement attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode; the scenario instead requires scope and associate appropriate WAF security policies to supported domains or path patterns. The differentiating evidence is that the protected login route enforces stronger policy while public static content stays accessible as designed.

Front Door WAF applies application-layer filtering at the Microsoft edge for protected routes. However, the option would implement associate a Front Door WAF policy with the intended endpoint domains through a security policy; the scenario instead requires scope and associate appropriate WAF security policies to supported domains or path patterns. The differentiating evidence is that the protected login route enforces stronger policy while public static content stays accessible as designed.

NSGs enforce network transport rules and do not parse application attack payloads. However, the option would implement deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters; the scenario instead requires scope and associate appropriate WAF security policies to supported domains or path patterns. The differentiating evidence is that the protected login route enforces stronger policy while public static content stays accessible as designed.

That observation would primarily validate another control: create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. The situation calls for evidence that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

That observation would primarily validate another control: add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace. Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. The situation calls for evidence that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

That observation would primarily validate another control: refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings. Existing workloads may retain DNS settings obtained before a VNet-level resolver change. The situation calls for evidence that after the planned TTL period, test clients consistently resolve the new address and connect successfully.