That observation would primarily validate another control: enable appropriate forwarded traffic settings on the relevant peering connections and retain correct return routes. Traffic forwarded by an NVA requires compatible peering settings as well as layer-3 routing. The situation calls for evidence that packet captures on both sides show request and response traversing the expected inspection point.

That observation would primarily validate another control: deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. Centralized change definitions make route and topology deviations detectable before deployment. The situation calls for evidence that packet captures on both sides show request and response traversing the expected inspection point.

That observation would primarily validate another control: configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. The situation calls for evidence that packet captures on both sides show request and response traversing the expected inspection point.

VNet peering is not intrinsically transitive; a route or gateway strategy is required for spoke-to-spoke transit. However, the option would implement design an explicit routed transit path using an NVA or supported hub routing architecture; the scenario instead requires associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop. The differentiating evidence is that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

Stateful firewalls need consistent bidirectional session visibility or supported asymmetric-flow handling. However, the option would implement validate symmetric request and return routes through the stateful inspection appliance; the scenario instead requires associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop. The differentiating evidence is that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

Subnet NAT Gateway supplies outbound-only address translation without creating VM public listeners. However, the option would implement place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs; the scenario instead requires associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop. The differentiating evidence is that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. However, the option would implement choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed; the scenario instead requires assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply. The differentiating evidence is that the migration workload retains the expected address behavior and communicates within supported scope.

Active-active VPN gateway instances can provide redundant tunnel paths when peer devices support the design. However, the option would implement configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints; the scenario instead requires assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply. The differentiating evidence is that the migration workload retains the expected address behavior and communicates within supported scope.

IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. However, the option would implement align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN; the scenario instead requires assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply. The differentiating evidence is that the migration workload retains the expected address behavior and communicates within supported scope.

Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. However, the option would implement configure P2S root certificate trust and issue valid client certificates from the approved CA; the scenario instead requires validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration. The differentiating evidence is that a managed device establishes the expected VPN under approved triggers without manual profile entry.

Client settings must match the endpoint, routes and auth mode configured on the gateway. However, the option would implement regenerate and distribute the appropriate Azure VPN client configuration profile after gateway changes; the scenario instead requires validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration. The differentiating evidence is that a managed device establishes the expected VPN under approved triggers without manual profile entry.

VPN authentication alone does not install all required routes to remote interconnected networks. However, the option would implement review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes; the scenario instead requires validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration. The differentiating evidence is that a managed device establishes the expected VPN under approved triggers without manual profile entry.

Front Door edge caching improves static content delivery only when caching policies respect dynamic or private data. However, the option would implement configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content; the scenario instead requires use Front Door Premium Private Link origin connectivity and configure compatible origin private access. The differentiating evidence is that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. However, the option would implement complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate; the scenario instead requires use Front Door Premium Private Link origin connectivity and configure compatible origin private access. The differentiating evidence is that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

Front Door rules can modify edge request handling before forwarding to origin services. However, the option would implement create Front Door rules for supported redirect or URL rewrite behavior on the matching route; the scenario instead requires use Front Door Premium Private Link origin connectivity and configure compatible origin private access. The differentiating evidence is that edge requests succeed through approved private link while direct unauthenticated public origin access is blocked.

That observation would primarily validate another control: use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends. Aggregated network views connect resource health and relevant network signals for operations analysis. The situation calls for evidence that the corrected resource recommendation clears after reassessment and its score contribution updates.

That observation would primarily validate another control: route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. Collecting network flows is useful only if relevant logs reach an authorized searchable destination. The situation calls for evidence that the corrected resource recommendation clears after reassessment and its score contribution updates.

That observation would primarily validate another control: set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection. Time-series health signals and actionable alert thresholds provide earlier detection than manual portal checks. The situation calls for evidence that the corrected resource recommendation clears after reassessment and its score contribution updates.

Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. However, the option would implement inspect the effective-route longest-prefix match and add the proper more-specific route where supported; the scenario instead requires compare effective routes and correct the conflicting UDR or route-propagation setting. The differentiating evidence is that the corrected NIC effective route points to the approved gateway and the application test succeeds.

NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. However, the option would implement attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet; the scenario instead requires compare effective routes and correct the conflicting UDR or route-propagation setting. The differentiating evidence is that the corrected NIC effective route points to the approved gateway and the application test succeeds.

Direct VNet peering does not resolve overlapping address-space ambiguity. However, the option would implement renumber overlapping VNet address spaces before peering or design a supported translation boundary; the scenario instead requires compare effective routes and correct the conflicting UDR or route-propagation setting. The differentiating evidence is that the corrected NIC effective route points to the approved gateway and the application test succeeds.

That observation would primarily validate another control: assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. The situation calls for evidence that connected clients receive valid pool addresses and their routes reach the targeted Azure private resources.

That observation would primarily validate another control: configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets. RADIUS authentication depends on an accessible server and consistent protocol/authentication configuration. The situation calls for evidence that connected clients receive valid pool addresses and their routes reach the targeted Azure private resources.

That observation would primarily validate another control: inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls. P2S gateway SKU limits and client tunnel health are distinct from account credential validity. The situation calls for evidence that connected clients receive valid pool addresses and their routes reach the targeted Azure private resources.

That observation would primarily validate another control: update the local network gateway resource with the remote VPN device public IP and correct prefixes. Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. The situation calls for evidence that the migration workload retains the expected address behavior and communicates within supported scope.

That observation would primarily validate another control: deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. The situation calls for evidence that the migration workload retains the expected address behavior and communicates within supported scope.

That observation would primarily validate another control: resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S. Identical local and remote prefixes make destination routing ambiguous across a site-to-site tunnel. The situation calls for evidence that the migration workload retains the expected address behavior and communicates within supported scope.

Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. However, the option would implement define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements; the scenario instead requires place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs. The differentiating evidence is that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. However, the option would implement use Azure Virtual Network Manager connectivity configurations and appropriate network groups; the scenario instead requires place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs. The differentiating evidence is that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

UDRs affect only subnets to which their route table is associated. However, the option would implement associate the intended route table with every subnet that must use that UDR policy; the scenario instead requires place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs. The differentiating evidence is that outbound tests use the reserved NAT address and the private VM NICs expose no inbound public IP.

That observation would primarily validate another control: place Front Door in front of appropriate regional origin gateways with correct host headers and probes. Front Door provides global entry and acceleration, while regional gateways retain local layer-7 capabilities. The situation calls for evidence that origin health remains stable and a controlled failure results in expected traffic diversion.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that origin health remains stable and a controlled failure results in expected traffic diversion.

That observation would primarily validate another control: complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. The situation calls for evidence that origin health remains stable and a controlled failure results in expected traffic diversion.