Front Door custom HTTPS requires domain ownership and a certificate matching the requested host. However, the option would implement complete Front Door custom-domain validation and bind a valid managed or approved TLS certificate; the scenario instead requires use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. The differentiating evidence is that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. However, the option would implement use Front Door Premium Private Link origin connectivity and configure compatible origin private access; the scenario instead requires use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. The differentiating evidence is that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

Front Door WAF evaluates incoming HTTP requests at the edge before routing to origins. However, the option would implement associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns; the scenario instead requires use supported Front Door rules and geographic filtering where appropriate, plus origin segregation. The differentiating evidence is that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

That observation would primarily validate another control: apply supported origin access restrictions using Front Door identification and approved security controls. Public origins need defenses against clients bypassing edge WAF and delivery rules. The situation calls for evidence that a controlled origin outage moves new requests to the healthy alternate without client DNS reconfiguration.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that a controlled origin outage moves new requests to the healthy alternate without client DNS reconfiguration.

That observation would primarily validate another control: configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content. Front Door edge caching improves static content delivery only when caching policies respect dynamic or private data. The situation calls for evidence that a controlled origin outage moves new requests to the healthy alternate without client DNS reconfiguration.

DNS-layer policy can block known malicious domains without treating an IP firewall allow rule as DNS security. However, the option would implement apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope; the scenario instead requires reduce record TTL before a planned migration and validate propagation and client cache expiry. The differentiating evidence is that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. However, the option would implement create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers; the scenario instead requires reduce record TTL before a planned migration and validate propagation and client cache expiry. The differentiating evidence is that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

DNS record types have distinct purposes: A provides IPv4 host resolution while MX selects mail exchangers. However, the option would implement create appropriate public-zone A records for IPv4 and MX records for mail routing; the scenario instead requires reduce record TTL before a planned migration and validate propagation and client cache expiry. The differentiating evidence is that after the planned TTL period, test clients consistently resolve the new address and connect successfully.

That observation would primarily validate another control: design Virtual WAN traffic security explicitly with compatible firewall and routing features. Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. The situation calls for evidence that workload Internet egress follows the secured hub firewall and a representative policy event is logged.

That observation would primarily validate another control: deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings. Virtual hubs need relevant gateways to terminate the actual connection type. The situation calls for evidence that workload Internet egress follows the secured hub firewall and a representative policy event is logged.

That observation would primarily validate another control: check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions. Virtual WAN hub interconnect and route propagation control cross-region VNet path availability. The situation calls for evidence that workload Internet egress follows the secured hub firewall and a representative policy event is logged.

Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. However, the option would implement select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication; the scenario instead requires inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls. The differentiating evidence is that gateway metrics show adequate capacity and the test client remains connected under a representative load.

P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. However, the option would implement constrain client routing and enforce destination access with NSGs and identity-aware controls; the scenario instead requires inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls. The differentiating evidence is that gateway metrics show adequate capacity and the test client remains connected under a representative load.

Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. However, the option would implement assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment; the scenario instead requires inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls. The differentiating evidence is that gateway metrics show adequate capacity and the test client remains connected under a representative load.

That observation would primarily validate another control: respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. The situation calls for evidence that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

That observation would primarily validate another control: define Azure Virtual Network Manager connectivity groups that meet isolation and hub-and-spoke requirements. Managed network groups and connectivity configurations express allowed topology rather than implicit full mesh. The situation calls for evidence that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

That observation would primarily validate another control: inspect the effective-route longest-prefix match and add the proper more-specific route where supported. Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. The situation calls for evidence that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

That observation would primarily validate another control: respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. The situation calls for evidence that the intended prefix appears on the affected NIC and a trace reaches the destination across the selected hop.

That observation would primarily validate another control: associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop. User-defined routes direct selected prefixes through a network virtual appliance when transparent inspection is required. The situation calls for evidence that the intended prefix appears on the affected NIC and a trace reaches the destination across the selected hop.

That observation would primarily validate another control: compare effective routes and correct the conflicting UDR or route-propagation setting. A working BGP control plane does not guarantee the desired next hop when route tables override propagated paths. The situation calls for evidence that the intended prefix appears on the affected NIC and a trace reaches the destination across the selected hop.

That observation would primarily validate another control: enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. BGP distributes network prefixes across compatible VPN peers, avoiding repeated manual network updates. The situation calls for evidence that the new prefix is visible in learned or configured routes and a specific application connection succeeds.

That observation would primarily validate another control: resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S. Identical local and remote prefixes make destination routing ambiguous across a site-to-site tunnel. The situation calls for evidence that the new prefix is visible in learned or configured routes and a specific application connection succeeds.

That observation would primarily validate another control: assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply. Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. The situation calls for evidence that the new prefix is visible in learned or configured routes and a specific application connection succeeds.

That observation would primarily validate another control: use private backend addressing and implement egress separately through a controlled outbound path. Outbound connectivity does not require each backend NIC to carry a public address or accept inbound traffic. The situation calls for evidence that the configured service is accepted by the subnet and deployment validation no longer reports delegation conflicts.

That observation would primarily validate another control: create purpose-specific subnets in the VNet and apply matching network security and routing controls. VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. The situation calls for evidence that the configured service is accepted by the subnet and deployment validation no longer reports delegation conflicts.

That observation would primarily validate another control: allocate a Public IP Prefix and create supported public IP resources from that prefix. Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. The situation calls for evidence that the configured service is accepted by the subnet and deployment validation no longer reports delegation conflicts.

That observation would primarily validate another control: configure an eligible health probe and backend listener that match the service port and NSG rules. Load Balancer health probes decide which backends are eligible for new flows. The situation calls for evidence that an approved connection traverses the appliance and appears in inspection logs before reaching the backend.

That observation would primarily validate another control: create inbound NAT rules that map unique frontend ports to designated backend endpoints. Inbound NAT rules target specific backend machines instead of spreading a flow across a load-balanced pool. The situation calls for evidence that an approved connection traverses the appliance and appears in inspection logs before reaching the backend.

That observation would primarily validate another control: adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. The situation calls for evidence that an approved connection traverses the appliance and appears in inspection logs before reaching the backend.

Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. However, the option would implement send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination; the scenario instead requires review Firewall Policy rule-collection-group and collection processing order and correct priorities. The differentiating evidence is that the expected collection handles a controlled test packet and its matching rule is logged.

Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. However, the option would implement deploy Azure Firewall into a supported hub and route workload egress through its private IP; the scenario instead requires review Firewall Policy rule-collection-group and collection processing order and correct priorities. The differentiating evidence is that the expected collection handles a controlled test packet and its matching rule is logged.

Azure Firewall provisioning requires its reserved subnet and adequate address capacity. However, the option would implement reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants; the scenario instead requires review Firewall Policy rule-collection-group and collection processing order and correct priorities. The differentiating evidence is that the expected collection handles a controlled test packet and its matching rule is logged.