That observation would primarily validate another control: enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. BGP distributes network prefixes across compatible VPN peers, avoiding repeated manual network updates. The situation calls for evidence that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

That observation would primarily validate another control: design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. Internet-bound branch traffic requires explicit default-route propagation and a compatible secured hub path. The situation calls for evidence that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

That observation would primarily validate another control: align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN. IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. The situation calls for evidence that the resolved prefix design produces distinct learned routes and branch traffic reaches the intended workload.

That observation would primarily validate another control: add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. The situation calls for evidence that an /api request and an unrelated path are served by the expected separate pools.

That observation would primarily validate another control: align Application Gateway backend host-name and health-probe configuration with the origin virtual host. Layer-7 backend routing and TLS validation depend on the host and protocol settings. The situation calls for evidence that an /api request and an unrelated path are served by the expected separate pools.

That observation would primarily validate another control: replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener. Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. The situation calls for evidence that an /api request and an unrelated path are served by the expected separate pools.

Front Door cache purging invalidates stale edge copies in supported scopes. However, the option would implement use the supported Front Door purge cache operation for affected URL patterns; the scenario instead requires approve the required private endpoint connection and verify the origin's private link health. The differentiating evidence is that private connection reaches approved state and a health probe becomes successful.

Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. However, the option would implement use Front Door Premium Private Link origin connectivity and configure compatible origin private access; the scenario instead requires approve the required private endpoint connection and verify the origin's private link health. The differentiating evidence is that private connection reaches approved state and a health probe becomes successful.

Front Door is a globally distributed application delivery service that proxies and routes HTTP(S) traffic to healthy origins. However, the option would implement deploy Azure Front Door with appropriate origin groups and endpoint routes; the scenario instead requires approve the required private endpoint connection and verify the origin's private link health. The differentiating evidence is that private connection reaches approved state and a health probe becomes successful.

Some Private Link connections require resource-owner approval before private traffic is accepted. However, the option would implement approve the intended private endpoint connection on the target resource before testing access; the scenario instead requires require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. The differentiating evidence is that unapproved endpoint requests stay pending or rejected and approved consumers connect successfully.

Private Link for multi-service resources may have different endpoint group IDs and DNS zones. However, the option would implement create the needed private endpoints and matching DNS zones for each required supported storage subresource; the scenario instead requires require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. The differentiating evidence is that unapproved endpoint requests stay pending or rejected and approved consumers connect successfully.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. The differentiating evidence is that unapproved endpoint requests stay pending or rejected and approved consumers connect successfully.

Tunnel control-plane status and Azure data-plane next-hop selection are separate conditions. However, the option would implement check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes; the scenario instead requires deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. The differentiating evidence is that the tunnel status is connected and representative branch subnets reach the approved Azure prefixes.

Identical local and remote prefixes make destination routing ambiguous across a site-to-site tunnel. However, the option would implement resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S; the scenario instead requires deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. The differentiating evidence is that the tunnel status is connected and representative branch subnets reach the approved Azure prefixes.

Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. However, the option would implement assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply; the scenario instead requires deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. The differentiating evidence is that the tunnel status is connected and representative branch subnets reach the approved Azure prefixes.

That observation would primarily validate another control: evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. ExpressRoute Direct offers dedicated port pairs for creating supported ExpressRoute circuits at high scale. The situation calls for evidence that a controlled primary-path outage retains a functional alternate route for the required workload.

That observation would primarily validate another control: enable ExpressRoute FastPath on compatible circuits, gateways and network resources. FastPath can improve the data path for supported ExpressRoute configurations by bypassing the gateway dataplane. The situation calls for evidence that a controlled primary-path outage retains a functional alternate route for the required workload.

That observation would primarily validate another control: correct BGP route advertisements and filters so the desired prefixes propagate in both directions. ExpressRoute reachability depends on the prefixes exchanged through established peering sessions. The situation calls for evidence that a controlled primary-path outage retains a functional alternate route for the required workload.

Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. However, the option would implement use supported Front Door rules and geographic filtering where appropriate, plus origin segregation; the scenario instead requires configure an appropriate lightweight unauthenticated Front Door origin health probe path. The differentiating evidence is that origin health remains stable and a controlled failure results in expected traffic diversion.

Front Door edge caching improves static content delivery only when caching policies respect dynamic or private data. However, the option would implement configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content; the scenario instead requires configure an appropriate lightweight unauthenticated Front Door origin health probe path. The differentiating evidence is that origin health remains stable and a controlled failure results in expected traffic diversion.

Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. However, the option would implement use Front Door Premium Private Link origin connectivity and configure compatible origin private access; the scenario instead requires configure an appropriate lightweight unauthenticated Front Door origin health probe path. The differentiating evidence is that origin health remains stable and a controlled failure results in expected traffic diversion.

Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. However, the option would implement use Defender for Cloud Cloud Security Explorer to query related security posture resources; the scenario instead requires route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. The differentiating evidence is that the analyst retrieves a time-bounded flow record for a representative deny and validates source and destination fields.

Attack path analysis evaluates connected weaknesses rather than treating each network setting in isolation. However, the option would implement use Defender for Cloud attack path analysis to identify exploitable exposure chains; the scenario instead requires route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. The differentiating evidence is that the analyst retrieves a time-bounded flow record for a representative deny and validates source and destination fields.

VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. However, the option would implement enable supported VNet flow logs with the intended storage and analysis configuration; the scenario instead requires route VNet flow telemetry into supported storage or traffic analytics with access and retention controls. The differentiating evidence is that the analyst retrieves a time-bounded flow record for a representative deny and validates source and destination fields.

Name resolution visibility is determined by private-zone linking and namespace selection. However, the option would implement separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links; the scenario instead requires apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. The differentiating evidence is that an authorized test query receives the intended block result and a policy event is recorded.

Public Azure DNS zones and private DNS zones have different visibility and delegation semantics. However, the option would implement plan internal private DNS zones and public DNS hosting as distinct authoritative resolution scopes; the scenario instead requires apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. The differentiating evidence is that an authorized test query receives the intended block result and a policy event is recorded.

DNS caching can delay a record change independently of network route availability. However, the option would implement reduce record TTL before a planned migration and validate propagation and client cache expiry; the scenario instead requires apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. The differentiating evidence is that an authorized test query receives the intended block result and a policy event is recorded.

That observation would primarily validate another control: store NSG configurations in versioned IaC and validate effective rules before and after deployment. Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. The situation calls for evidence that only the named approved source can open the management or database port while unapproved sources are denied.

That observation would primarily validate another control: match NSG rules to the effective private source and destination packet addresses at the NIC boundary. NSG policy evaluation sees packet addresses at its network scope rather than assuming Internet NAT addresses. The situation calls for evidence that only the named approved source can open the management or database port while unapproved sources are denied.

That observation would primarily validate another control: create an application security group and reference it in supported NSG rules for member network interfaces. ASGs identify groups of NICs for rule targets without hard-coding changing workload IPs. The situation calls for evidence that only the named approved source can open the management or database port while unapproved sources are denied.

A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. However, the option would implement review effective routes and keep the explicit appliance route when inspected forced tunneling is required; the scenario instead requires use Azure Route Server with a supported BGP peer to exchange routes dynamically. The differentiating evidence is that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

UDRs affect only subnets to which their route table is associated. However, the option would implement associate the intended route table with every subnet that must use that UDR policy; the scenario instead requires use Azure Route Server with a supported BGP peer to exchange routes dynamically. The differentiating evidence is that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. However, the option would implement define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements; the scenario instead requires use Azure Route Server with a supported BGP peer to exchange routes dynamically. The differentiating evidence is that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.