A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. However, the option would implement review effective routes and keep the explicit appliance route when inspected forced tunneling is required; the scenario instead requires use Azure Route Server with a supported BGP peer to exchange routes dynamically. The differentiating evidence is that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

UDRs affect only subnets to which their route table is associated. However, the option would implement associate the intended route table with every subnet that must use that UDR policy; the scenario instead requires use Azure Route Server with a supported BGP peer to exchange routes dynamically. The differentiating evidence is that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. However, the option would implement define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements; the scenario instead requires use Azure Route Server with a supported BGP peer to exchange routes dynamically. The differentiating evidence is that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

That observation would primarily validate another control: use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources. A public IP creates a public addressing surface; internal reachability and managed private services usually do not need one. The situation calls for evidence that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

That observation would primarily validate another control: use private backend addressing and implement egress separately through a controlled outbound path. Outbound connectivity does not require each backend NIC to carry a public address or accept inbound traffic. The situation calls for evidence that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

That observation would primarily validate another control: allocate a Public IP Prefix and create supported public IP resources from that prefix. Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. The situation calls for evidence that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

That observation would primarily validate another control: register eligible NIC IP configurations or supported resources in the load balancer backend pool. Load balancing applies only to members registered in its backend pool and passing health checks. The situation calls for evidence that connecting to the assigned frontend management port consistently reaches the intended backend instance.

That observation would primarily validate another control: use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers. Cross-region Load Balancer extends supported layer-4 distribution across healthy regional frontends. The situation calls for evidence that connecting to the assigned frontend management port consistently reaches the intended backend instance.

That observation would primarily validate another control: use Gateway Load Balancer and a supported transparent NVA service-chain configuration. Gateway Load Balancer integrates compatible NVAs into traffic flow without application-layer URL routing. The situation calls for evidence that connecting to the assigned frontend management port consistently reaches the intended backend instance.

Attack path analysis evaluates connected weaknesses rather than treating each network setting in isolation. However, the option would implement use Defender for Cloud attack path analysis to identify exploitable exposure chains; the scenario instead requires review Defender for Cloud Secure Score security recommendations for network resources. The differentiating evidence is that the corrected resource recommendation clears after reassessment and its score contribution updates.

VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. However, the option would implement enable supported VNet flow logs with the intended storage and analysis configuration; the scenario instead requires review Defender for Cloud Secure Score security recommendations for network resources. The differentiating evidence is that the corrected resource recommendation clears after reassessment and its score contribution updates.

Effective NSG evaluation identifies the allow or deny rule governing a specific flow. However, the option would implement use Network Watcher IP flow verify or effective security rules for the exact source/destination tuple; the scenario instead requires review Defender for Cloud Secure Score security recommendations for network resources. The differentiating evidence is that the corrected resource recommendation clears after reassessment and its score contribution updates.

That observation would primarily validate another control: check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes. Tunnel control-plane status and Azure data-plane next-hop selection are separate conditions. The situation calls for evidence that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

That observation would primarily validate another control: assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply. Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. The situation calls for evidence that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

That observation would primarily validate another control: resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S. Identical local and remote prefixes make destination routing ambiguous across a site-to-site tunnel. The situation calls for evidence that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

That observation would primarily validate another control: remove or reject only the obsolete private endpoint connection and clean up its DNS records. Private Link consumer connections can be managed individually without deleting the underlying PaaS resource. The situation calls for evidence that the connection status shows approved and the authorized client completes the expected service handshake.

That observation would primarily validate another control: require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. Connection approval separates consumer endpoint provisioning from provider authorization. The situation calls for evidence that the connection status shows approved and the authorized client completes the expected service handshake.

That observation would primarily validate another control: verify the service's VNet integration outbound route and private DNS configuration in the integration environment. The caller's own network integration and resolver path control whether it can use a private endpoint. The situation calls for evidence that the connection status shows approved and the authorized client completes the expected service handshake.

Global Reach connects supported on-premises networks through eligible ExpressRoute circuit relationships. However, the option would implement use ExpressRoute Global Reach between eligible circuits and confirm support across their locations; the scenario instead requires add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate. The differentiating evidence is that an approved packet inspection or tunnel check confirms encryption on the required connection segment.

ExpressRoute Direct offers dedicated port pairs for creating supported ExpressRoute circuits at high scale. However, the option would implement evaluate ExpressRoute Direct and its dedicated port and peering-location requirements; the scenario instead requires add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate. The differentiating evidence is that an approved packet inspection or tunnel check confirms encryption on the required connection segment.

ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. However, the option would implement select an ExpressRoute SKU and connectivity design that supports the needed geographic reach; the scenario instead requires add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate. The differentiating evidence is that an approved packet inspection or tunnel check confirms encryption on the required connection segment.

That observation would primarily validate another control: approve the intended private endpoint connection on the target resource before testing access. Some Private Link connections require resource-owner approval before private traffic is accepted. The situation calls for evidence that a request from the actual integrated service resolves the endpoint privately and completes the database query.

That observation would primarily validate another control: restrict or disable the PaaS resource's public network access separately from creating its private endpoint. Private endpoints do not necessarily disable a service's existing public network endpoint automatically. The situation calls for evidence that a request from the actual integrated service resolves the endpoint privately and completes the database query.

That observation would primarily validate another control: create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration. Private endpoints map a supported PaaS service into a VNet through a private network interface. The situation calls for evidence that a request from the actual integrated service resolves the endpoint privately and completes the database query.

Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. However, the option would implement use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing; the scenario instead requires configure Azure Traffic Manager with the correct routing method and endpoint health checks. The differentiating evidence is that dNS answers choose an eligible healthy endpoint and switch after a controlled failure within expected TTL behavior.

Gateway Load Balancer integrates compatible NVAs into traffic flow without application-layer URL routing. However, the option would implement use Gateway Load Balancer and a supported transparent NVA service-chain configuration; the scenario instead requires configure Azure Traffic Manager with the correct routing method and endpoint health checks. The differentiating evidence is that dNS answers choose an eligible healthy endpoint and switch after a controlled failure within expected TTL behavior.

High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. However, the option would implement configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules; the scenario instead requires configure Azure Traffic Manager with the correct routing method and endpoint health checks. The differentiating evidence is that dNS answers choose an eligible healthy endpoint and switch after a controlled failure within expected TTL behavior.

That observation would primarily validate another control: attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet. NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. The situation calls for evidence that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

That observation would primarily validate another control: renumber overlapping VNet address spaces before peering or design a supported translation boundary. Direct VNet peering does not resolve overlapping address-space ambiguity. The situation calls for evidence that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

That observation would primarily validate another control: inspect the effective-route longest-prefix match and add the proper more-specific route where supported. Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. The situation calls for evidence that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

That observation would primarily validate another control: enable autoregistration for the appropriate VNet link to an Azure Private DNS zone. Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. The situation calls for evidence that an authorized test query receives the intended block result and a policy event is recorded.

That observation would primarily validate another control: create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints. Inbound and outbound resolver endpoints use dedicated subnets that cannot host unrelated workloads. The situation calls for evidence that an authorized test query receives the intended block result and a policy event is recorded.

That observation would primarily validate another control: separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. Name resolution visibility is determined by private-zone linking and namespace selection. The situation calls for evidence that an authorized test query receives the intended block result and a policy event is recorded.