That observation would primarily validate another control: place Front Door in front of appropriate regional origin gateways with correct host headers and probes. Front Door provides global entry and acceleration, while regional gateways retain local layer-7 capabilities. The situation calls for evidence that origin health remains stable and a controlled failure results in expected traffic diversion.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that origin health remains stable and a controlled failure results in expected traffic diversion.

That observation would primarily validate another control: complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate. Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. The situation calls for evidence that origin health remains stable and a controlled failure results in expected traffic diversion.

That observation would primarily validate another control: configure appropriate multi-site listeners and host-based routing rules on Application Gateway. Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. The situation calls for evidence that the probe stops reporting hostname errors and a client request reaches the correct virtual host.

That observation would primarily validate another control: enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. The situation calls for evidence that the probe stops reporting hostname errors and a client request reaches the correct virtual host.

That observation would primarily validate another control: configure path-based routing rules and suitable default backend pool in Application Gateway. URL path maps select backend targets on HTTP path matches, with default behavior for other paths. The situation calls for evidence that the probe stops reporting hostname errors and a client request reaches the correct virtual host.

Gateway Load Balancer integrates compatible NVAs into traffic flow without application-layer URL routing. However, the option would implement use Gateway Load Balancer and a supported transparent NVA service-chain configuration; the scenario instead requires use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing. The differentiating evidence is that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

Load Balancer health probes decide which backends are eligible for new flows. However, the option would implement configure an eligible health probe and backend listener that match the service port and NSG rules; the scenario instead requires use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing. The differentiating evidence is that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. However, the option would implement configure suitable load-balancing rules including HA ports where the chosen internal design supports them; the scenario instead requires use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing. The differentiating evidence is that distinct URL paths arrive at the specified backend pools without separate client-facing ports.

A missing application log can result from network filtering or an unavailable listener; both need evidence. However, the option would implement use Network Watcher connection testing and IP flow verify alongside service listener checks; the scenario instead requires create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points. The differentiating evidence is that a controlled source-address test is denied while permitted client ranges remain reachable.

NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. However, the option would implement correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering; the scenario instead requires create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points. The differentiating evidence is that a controlled source-address test is denied while permitted client ranges remain reachable.

Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. However, the option would implement create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route; the scenario instead requires create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points. The differentiating evidence is that a controlled source-address test is denied while permitted client ranges remain reachable.

That observation would primarily validate another control: configure Azure VPN Gateway point-to-site connectivity with an approved tunnel and client profile. Point-to-site VPN is designed for individual client devices rather than fixed network-to-network peer sites. The situation calls for evidence that a valid test client establishes the VPN while a certificate from an untrusted issuer is denied.

That observation would primarily validate another control: review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes. VPN authentication alone does not install all required routes to remote interconnected networks. The situation calls for evidence that a valid test client establishes the VPN while a certificate from an untrusted issuer is denied.

That observation would primarily validate another control: select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication. Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. The situation calls for evidence that a valid test client establishes the VPN while a certificate from an untrusted issuer is denied.

A service endpoint is a VNet subnet property and does not directly make arbitrary branch source IPs part of that subnet. However, the option would implement use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required; the scenario instead requires combine service endpoint network rules with proper service authentication and RBAC or access policies. The differentiating evidence is that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

Service endpoints are configured at subnet level, not automatically across an entire VNet. However, the option would implement enable the supported service endpoint on each specific subnet that requires the Azure service network identity; the scenario instead requires combine service endpoint network rules with proper service authentication and RBAC or access policies. The differentiating evidence is that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. However, the option would implement choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing; the scenario instead requires combine service endpoint network rules with proper service authentication and RBAC or access policies. The differentiating evidence is that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. However, the option would implement add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing; the scenario instead requires align Application Gateway backend host-name and health-probe configuration with the origin virtual host. The differentiating evidence is that the probe stops reporting hostname errors and a client request reaches the correct virtual host.

Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. However, the option would implement attach a supported Application Gateway WAF policy in the intended enforcement mode; the scenario instead requires align Application Gateway backend host-name and health-probe configuration with the origin virtual host. The differentiating evidence is that the probe stops reporting hostname errors and a client request reaches the correct virtual host.

Rewrite rules modify supported HTTP header and URL aspects without requiring changes in every backend service. However, the option would implement configure an Application Gateway rewrite rule set matching the required request or response conditions; the scenario instead requires align Application Gateway backend host-name and health-probe configuration with the origin virtual host. The differentiating evidence is that the probe stops reporting hostname errors and a client request reaches the correct virtual host.

Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. However, the option would implement configure Microsoft peering only for eligible services and with the required prefix authorization and route filters; the scenario instead requires evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. The differentiating evidence is that the provisioned ports and circuits match ordered capacity and private peering routes become usable.

Circuit health and private peering do not guarantee a workload selects that route over more specific UDR entries. However, the option would implement inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection; the scenario instead requires evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. The differentiating evidence is that the provisioned ports and circuits match ordered capacity and private peering routes become usable.

Private peering is a BGP arrangement and cannot establish with inconsistent peer identifiers or IP addressing. However, the option would implement match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters; the scenario instead requires evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. The differentiating evidence is that the provisioned ports and circuits match ordered capacity and private peering routes become usable.

NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. However, the option would implement combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth; the scenario instead requires use supported Azure Firewall FQDN tags or service-aware policy features where applicable. The differentiating evidence is that the intended Azure service stays reachable after endpoint changes without permitting unrelated public destinations.

Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. However, the option would implement deploy Azure Firewall into a supported hub and route workload egress through its private IP; the scenario instead requires use supported Azure Firewall FQDN tags or service-aware policy features where applicable. The differentiating evidence is that the intended Azure service stays reachable after endpoint changes without permitting unrelated public destinations.

Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. However, the option would implement send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination; the scenario instead requires use supported Azure Firewall FQDN tags or service-aware policy features where applicable. The differentiating evidence is that the intended Azure service stays reachable after endpoint changes without permitting unrelated public destinations.

UDRs affect only subnets to which their route table is associated. However, the option would implement associate the intended route table with every subnet that must use that UDR policy; the scenario instead requires configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. The differentiating evidence is that the spoke effective routes include on-premises prefixes and branch application traffic passes the gateway.

Route Server exchanges BGP information with compatible appliances and Azure networking instead of relying on static edits. However, the option would implement use Azure Route Server with a supported BGP peer to exchange routes dynamically; the scenario instead requires configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. The differentiating evidence is that the spoke effective routes include on-premises prefixes and branch application traffic passes the gateway.

Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. However, the option would implement define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements; the scenario instead requires configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. The differentiating evidence is that the spoke effective routes include on-premises prefixes and branch application traffic passes the gateway.

That observation would primarily validate another control: enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. BGP distributes network prefixes across compatible VPN peers, avoiding repeated manual network updates. The situation calls for evidence that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

That observation would primarily validate another control: design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. Internet-bound branch traffic requires explicit default-route propagation and a compatible secured hub path. The situation calls for evidence that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

That observation would primarily validate another control: align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN. IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. The situation calls for evidence that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.