That observation would primarily validate another control: provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration. P2S connection establishes reachability but private DNS lookup depends on client and gateway DNS settings. The situation calls for evidence that the revoked client fails authentication while a valid approved certificate still connects.

That observation would primarily validate another control: constrain client routing and enforce destination access with NSGs and identity-aware controls. P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. The situation calls for evidence that the revoked client fails authentication while a valid approved certificate still connects.

That observation would primarily validate another control: assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. The situation calls for evidence that the revoked client fails authentication while a valid approved certificate still connects.

That observation would primarily validate another control: align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN. IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. The situation calls for evidence that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

That observation would primarily validate another control: enable hub gateway transit and compatible remote-gateway peering usage on the spoke. Gateway transit makes the shared hub VPN connection available to eligible peered spokes. The situation calls for evidence that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

That observation would primarily validate another control: design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. Internet-bound branch traffic requires explicit default-route propagation and a compatible secured hub path. The situation calls for evidence that the Azure tunnel targets the correct public peer and routes include the intended branch prefixes.

That observation would primarily validate another control: apply a narrowly scoped NSG inbound allow rule for the approved sources and keep higher-level deny controls. NSGs filter packet tuples at subnet or NIC scope and can restrict access by source, destination, port and protocol. The situation calls for evidence that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

That observation would primarily validate another control: correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering. NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. The situation calls for evidence that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

That observation would primarily validate another control: update NSG source or ASG membership for the new workload placement after validating its identity. IP-prefix and application security group membership determine which NSG rules match relocated workloads. The situation calls for evidence that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

BGP distributes network prefixes across compatible VPN peers, avoiding repeated manual network updates. However, the option would implement enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements; the scenario instead requires enable hub gateway transit and compatible remote-gateway peering usage on the spoke. The differentiating evidence is that branch clients reach the spoke prefix and the spoke effective route uses the hub's remote gateway.

Tunnel control-plane status and Azure data-plane next-hop selection are separate conditions. However, the option would implement check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes; the scenario instead requires enable hub gateway transit and compatible remote-gateway peering usage on the spoke. The differentiating evidence is that branch clients reach the spoke prefix and the spoke effective route uses the hub's remote gateway.

Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. However, the option would implement assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply; the scenario instead requires enable hub gateway transit and compatible remote-gateway peering usage on the spoke. The differentiating evidence is that branch clients reach the spoke prefix and the spoke effective route uses the hub's remote gateway.

Virtual hubs need relevant gateways to terminate the actual connection type. However, the option would implement deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings; the scenario instead requires provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits. The differentiating evidence is that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

Basic and Standard Virtual WAN SKUs expose different hub and connectivity capabilities. However, the option would implement select the Virtual WAN Standard tier for required advanced connectivity and secured virtual hub features; the scenario instead requires provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits. The differentiating evidence is that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

Virtual WAN supports user VPN gateways for individually authenticated client connectivity. However, the option would implement deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration; the scenario instead requires provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits. The differentiating evidence is that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that private connection reaches approved state and a health probe becomes successful.

That observation would primarily validate another control: create Front Door rules for supported redirect or URL rewrite behavior on the matching route. Front Door rules can modify edge request handling before forwarding to origin services. The situation calls for evidence that private connection reaches approved state and a health probe becomes successful.

That observation would primarily validate another control: apply supported origin access restrictions using Front Door identification and approved security controls. Public origins need defenses against clients bypassing edge WAF and delivery rules. The situation calls for evidence that private connection reaches approved state and a health probe becomes successful.

That observation would primarily validate another control: separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. Name resolution visibility is determined by private-zone linking and namespace selection. The situation calls for evidence that a client in a linked VNet resolves the office-only record through the approved target DNS servers.

That observation would primarily validate another control: create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. The situation calls for evidence that a client in a linked VNet resolves the office-only record through the approved target DNS servers.

That observation would primarily validate another control: plan internal private DNS zones and public DNS hosting as distinct authoritative resolution scopes. Public Azure DNS zones and private DNS zones have different visibility and delegation semantics. The situation calls for evidence that a client in a linked VNet resolves the office-only record through the approved target DNS servers.

That observation would primarily validate another control: configure Front Door origin-group health probes and suitable priority or weight settings. Front Door origin selection depends on health probes and configured origin priority or weight. The situation calls for evidence that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

That observation would primarily validate another control: configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content. Front Door edge caching improves static content delivery only when caching policies respect dynamic or private data. The situation calls for evidence that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

That observation would primarily validate another control: use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. Edge routing and security policies can restrict traffic patterns and backend selection in supported scenarios. The situation calls for evidence that tLS checks succeed at the edge and origin, and origin requests use HTTPS with an expected certificate.

That observation would primarily validate another control: use WAF diagnostic logs to identify matched policy, rule and client/request details. Requests stopped by WAF may not reach backend application logs; WAF telemetry gives enforcement context. The situation calls for evidence that the safe test produces the expected block status and origin logs show no delivered malicious request.

That observation would primarily validate another control: define WAF custom geographic match rules or supported edge access controls for the target domains. Geographic filtering requires explicit request-based policy and should not be confused with backend origin placement. The situation calls for evidence that the safe test produces the expected block status and origin logs show no delivered malicious request.

That observation would primarily validate another control: associate the WAF policy to the intended Application Gateway scope, listener or route as supported. A standalone policy object does not inspect traffic until attached to an applicable gateway scope. The situation calls for evidence that the safe test produces the expected block status and origin logs show no delivered malicious request.

VPN disconnect and gateway events require historical telemetry, not only current status views. However, the option would implement collect virtual network gateway diagnostic logs and metrics into centralized monitoring; the scenario instead requires use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes. The differentiating evidence is that the diagnostic report pinpoints the failing hop or rule and a retest passes after the targeted correction.

An allow rule alone cannot establish name resolution, correct next hop and application endpoint identity. However, the option would implement collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes; the scenario instead requires use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes. The differentiating evidence is that the diagnostic report pinpoints the failing hop or rule and a retest passes after the targeted correction.

Time-series health signals and actionable alert thresholds provide earlier detection than manual portal checks. However, the option would implement set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection; the scenario instead requires use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes. The differentiating evidence is that the diagnostic report pinpoints the failing hop or rule and a retest passes after the targeted correction.

Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. However, the option would implement complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate; the scenario instead requires use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. The differentiating evidence is that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. However, the option would implement use Front Door Premium Private Link origin connectivity and configure compatible origin private access; the scenario instead requires use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. The differentiating evidence is that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

Front Door WAF evaluates incoming HTTP requests at the edge before routing to origins. However, the option would implement associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns; the scenario instead requires use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. The differentiating evidence is that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.