Peering and hybrid routing require unambiguous destinations; overlapping prefixes prevent intended reachability. However, the option would implement allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity; the scenario instead requires add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. The differentiating evidence is that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. However, the option would implement create purpose-specific subnets in the VNet and apply matching network security and routing controls; the scenario instead requires add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. The differentiating evidence is that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. However, the option would implement create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet; the scenario instead requires add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. The differentiating evidence is that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

That observation would primarily validate another control: create an internal Azure Load Balancer with a private frontend and eligible backend pool. Azure Load Balancer distributes layer-4 traffic to backend endpoints while an internal frontend stays private. The situation calls for evidence that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

That observation would primarily validate another control: use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers. Cross-region Load Balancer extends supported layer-4 distribution across healthy regional frontends. The situation calls for evidence that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

That observation would primarily validate another control: use Traffic Manager Performance routing with enabled healthy endpoints. Performance routing maps DNS clients to suitable regional endpoints using the Traffic Manager performance model. The situation calls for evidence that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

That observation would primarily validate another control: deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings. Virtual hubs need relevant gateways to terminate the actual connection type. The situation calls for evidence that the spoke effective routes show required branch prefixes and approved application tests pass.

That observation would primarily validate another control: choose the appropriate Virtual WAN hub gateway scale units and capacity parameters. Different Virtual WAN gateway types have configurable scale units and supported limits. The situation calls for evidence that the spoke effective routes show required branch prefixes and approved application tests pass.

That observation would primarily validate another control: design Virtual WAN traffic security explicitly with compatible firewall and routing features. Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. The situation calls for evidence that the spoke effective routes show required branch prefixes and approved application tests pass.

That observation would primarily validate another control: correct Virtual WAN route table associations and propagation labels for the connected networks. Virtual hub routing depends on the association and propagation configuration of each connection. The situation calls for evidence that the intended gateway and secured-hub features can be provisioned and expected connections establish.

That observation would primarily validate another control: deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections. Virtual WAN Standard supports centralized hub routing and expanded branch/VNet connectivity services. The situation calls for evidence that the intended gateway and secured-hub features can be provisioned and expected connections establish.

That observation would primarily validate another control: deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration. Virtual WAN supports user VPN gateways for individually authenticated client connectivity. The situation calls for evidence that the intended gateway and secured-hub features can be provisioned and expected connections establish.

That observation would primarily validate another control: allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity. Peering and hybrid routing require unambiguous destinations; overlapping prefixes prevent intended reachability. The situation calls for evidence that both endpoints receive private addresses and approved clients connect using the corresponding endpoint records.

That observation would primarily validate another control: create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. The situation calls for evidence that both endpoints receive private addresses and approved clients connect using the corresponding endpoint records.

That observation would primarily validate another control: create purpose-specific subnets in the VNet and apply matching network security and routing controls. VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. The situation calls for evidence that both endpoints receive private addresses and approved clients connect using the corresponding endpoint records.

IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. However, the option would implement add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends; the scenario instead requires use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs. The differentiating evidence is that the validated custom prefix reaches the commissioned state and allocated resource IPs are in the owned block.

Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. However, the option would implement place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets; the scenario instead requires use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs. The differentiating evidence is that the validated custom prefix reaches the commissioned state and allocated resource IPs are in the owned block.

A standalone VM public IP attachment belongs to a NIC IP configuration and a static allocation preserves its address. However, the option would implement associate a supported static public IP resource with the correct VM network interface configuration; the scenario instead requires use a Custom IP Prefix with ownership validation and supported commissioning before deriving Azure public IPs. The differentiating evidence is that the validated custom prefix reaches the commissioned state and allocated resource IPs are in the owned block.

That observation would primarily validate another control: limit WAF exclusions to the smallest required match variable, field or rule. Broad WAF exclusions create avoidable blind spots while a targeted exception can preserve other detection coverage. The situation calls for evidence that a controlled burst triggers the intended policy while ordinary client traffic is permitted.

That observation would primarily validate another control: use WAF diagnostic logs to identify matched policy, rule and client/request details. Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. The situation calls for evidence that a controlled burst triggers the intended policy while ordinary client traffic is permitted.

That observation would primarily validate another control: review WAF rule version and change impacts, then tune narrowly based on diagnostic evidence. Managed rule set versions can change match behavior and should be tested against legitimate traffic. The situation calls for evidence that a controlled burst triggers the intended policy while ordinary client traffic is permitted.

That observation would primarily validate another control: collect virtual network gateway diagnostic logs and metrics into centralized monitoring. VPN disconnect and gateway events require historical telemetry, not only current status views. The situation calls for evidence that the query returns the expected exposed resources and excludes remediated or out-of-scope assets.

That observation would primarily validate another control: use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes. Connection troubleshoot evaluates the actual source-to-destination path rather than guessing from VM health status. The situation calls for evidence that the query returns the expected exposed resources and excludes remediated or out-of-scope assets.

That observation would primarily validate another control: inventory DDoS protection plan associations and protected public IP resources in governance checks. A DDoS plan or protection policy only helps resources properly associated within its supported scope. The situation calls for evidence that the query returns the expected exposed resources and excludes remediated or out-of-scope assets.

Edge origin health assessment should use a consistently reachable probe without costly application side effects. However, the option would implement configure an appropriate lightweight unauthenticated Front Door origin health probe path; the scenario instead requires configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates. The differentiating evidence is that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

Front Door rules can modify edge request handling before forwarding to origin services. However, the option would implement create Front Door rules for supported redirect or URL rewrite behavior on the matching route; the scenario instead requires configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates. The differentiating evidence is that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

Public origins need defenses against clients bypassing edge WAF and delivery rules. However, the option would implement apply supported origin access restrictions using Front Door identification and approved security controls; the scenario instead requires configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates. The differentiating evidence is that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. However, the option would implement update local network gateway address spaces or validated BGP advertisements for the missing prefix; the scenario instead requires update the local network gateway resource with the remote VPN device public IP and correct prefixes. The differentiating evidence is that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. However, the option would implement assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply; the scenario instead requires update the local network gateway resource with the remote VPN device public IP and correct prefixes. The differentiating evidence is that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. However, the option would implement deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device; the scenario instead requires update the local network gateway resource with the remote VPN device public IP and correct prefixes. The differentiating evidence is that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

That observation would primarily validate another control: create an Azure Firewall application rule scoped to the required FQDN and protocol. Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. The situation calls for evidence that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

That observation would primarily validate another control: use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. The situation calls for evidence that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

That observation would primarily validate another control: use supported Azure Firewall FQDN tags or service-aware policy features where applicable. Managed service and FQDN tags reduce brittle static destination-IP maintenance for supported services. The situation calls for evidence that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.