Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. However, the option would implement send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination; the scenario instead requires review Firewall Policy rule-collection-group and collection processing order and correct priorities. The differentiating evidence is that the expected collection handles a controlled test packet and its matching rule is logged.

Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. However, the option would implement deploy Azure Firewall into a supported hub and route workload egress through its private IP; the scenario instead requires review Firewall Policy rule-collection-group and collection processing order and correct priorities. The differentiating evidence is that the expected collection handles a controlled test packet and its matching rule is logged.

Azure Firewall provisioning requires its reserved subnet and adequate address capacity. However, the option would implement reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants; the scenario instead requires review Firewall Policy rule-collection-group and collection processing order and correct priorities. The differentiating evidence is that the expected collection handles a controlled test packet and its matching rule is logged.

Policy-as-code plus effective-rule comparison reduces undetected drift and accidental priority conflicts. However, the option would implement store NSG configurations in versioned IaC and validate effective rules before and after deployment; the scenario instead requires use the appropriate Azure service tag for supported NSG destination restrictions. The differentiating evidence is that traffic to the intended service is allowed and unrelated Internet destinations stay blocked.

Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. However, the option would implement inspect effective security rules and IP flow verify for the exact source, destination, protocol and port; the scenario instead requires use the appropriate Azure service tag for supported NSG destination restrictions. The differentiating evidence is that traffic to the intended service is allowed and unrelated Internet destinations stay blocked.

A missing application log can result from network filtering or an unavailable listener; both need evidence. However, the option would implement use Network Watcher connection testing and IP flow verify alongside service listener checks; the scenario instead requires use the appropriate Azure service tag for supported NSG destination restrictions. The differentiating evidence is that traffic to the intended service is allowed and unrelated Internet destinations stay blocked.

Certificate trust must be able to exclude compromised or retired client certificates. However, the option would implement revoke or deny the specific P2S client certificate by supported gateway configuration and policy; the scenario instead requires configure Azure VPN Gateway point-to-site connectivity with an approved tunnel and client profile. The differentiating evidence is that an authorized remote device connects and reaches an approved private Azure subnet.

Always On VPN is a client-side management design with specific tunnel and infrastructure requirements. However, the option would implement validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration; the scenario instead requires configure Azure VPN Gateway point-to-site connectivity with an approved tunnel and client profile. The differentiating evidence is that an authorized remote device connects and reaches an approved private Azure subnet.

Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. However, the option would implement configure P2S root certificate trust and issue valid client certificates from the approved CA; the scenario instead requires configure Azure VPN Gateway point-to-site connectivity with an approved tunnel and client profile. The differentiating evidence is that an authorized remote device connects and reaches an approved private Azure subnet.

That observation would primarily validate another control: use a private endpoint instead of a service endpoint for private-IP service access. Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. The situation calls for evidence that requests from enabled subnets match intended service rules; an unconfigured subnet remains excluded.

That observation would primarily validate another control: add the selected VNet/subnet to the target service's virtual network access rules. Service endpoint enablement alone does not grant access at the PaaS service network policy layer. The situation calls for evidence that requests from enabled subnets match intended service rules; an unconfigured subnet remains excluded.

That observation would primarily validate another control: use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required. A service endpoint is a VNet subnet property and does not directly make arbitrary branch source IPs part of that subnet. The situation calls for evidence that requests from enabled subnets match intended service rules; an unconfigured subnet remains excluded.

That observation would primarily validate another control: use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. BFD can detect forwarding failures rapidly and inform BGP convergence where supported. The situation calls for evidence that an approved packet inspection or tunnel check confirms encryption on the required connection segment.

That observation would primarily validate another control: correct BGP route advertisements and filters so the desired prefixes propagate in both directions. ExpressRoute reachability depends on the prefixes exchanged through established peering sessions. The situation calls for evidence that an approved packet inspection or tunnel check confirms encryption on the required connection segment.

That observation would primarily validate another control: configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. The situation calls for evidence that an approved packet inspection or tunnel check confirms encryption on the required connection segment.

That observation would primarily validate another control: use Azure Bastion or a tightly restricted approved management entry path and remove open RDP ingress. Direct Internet-wide RDP exposure is unnecessary when managed private administration is available. The situation calls for evidence that traffic to the intended service is allowed and unrelated Internet destinations stay blocked.

That observation would primarily validate another control: use Azure Virtual Network Manager security admin configurations within supported scope. Security admin rules can centrally enforce network intent across managed VNet groups. The situation calls for evidence that traffic to the intended service is allowed and unrelated Internet destinations stay blocked.

That observation would primarily validate another control: configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules. Outbound client-initiated traffic and unsolicited inbound sessions are separate NSG directions. The situation calls for evidence that traffic to the intended service is allowed and unrelated Internet destinations stay blocked.

Private peering is a BGP arrangement and cannot establish with inconsistent peer identifiers or IP addressing. However, the option would implement match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters; the scenario instead requires evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. The differentiating evidence is that the provisioned ports and circuits match ordered capacity and private peering routes become usable.

Global Reach connects supported on-premises networks through eligible ExpressRoute circuit relationships. However, the option would implement use ExpressRoute Global Reach between eligible circuits and confirm support across their locations; the scenario instead requires evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. The differentiating evidence is that the provisioned ports and circuits match ordered capacity and private peering routes become usable.

ExpressRoute provides private connectivity through a provider path, subject to service and circuit design. However, the option would implement provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering; the scenario instead requires evaluate ExpressRoute Direct and its dedicated port and peering-location requirements. The differentiating evidence is that the provisioned ports and circuits match ordered capacity and private peering routes become usable.

Name resolution visibility is determined by private-zone linking and namespace selection. However, the option would implement separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links; the scenario instead requires add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace. The differentiating evidence is that lookups through the VNet's configured DNS server return private endpoint addresses for the zone suffix.

Existing workloads may retain DNS settings obtained before a VNet-level resolver change. However, the option would implement refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings; the scenario instead requires add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace. The differentiating evidence is that lookups through the VNet's configured DNS server return private endpoint addresses for the zone suffix.

Correct name resolution does not create connectivity; routing, firewall and endpoint access still matter. However, the option would implement validate DNS resolution separately from IP routing and provide an approved private network path; the scenario instead requires add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace. The differentiating evidence is that lookups through the VNet's configured DNS server return private endpoint addresses for the zone suffix.

Existing workloads may retain DNS settings obtained before a VNet-level resolver change. However, the option would implement refresh affected VM DHCP leases or restart network interfaces after changing VNet DNS server settings; the scenario instead requires configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. The differentiating evidence is that a client in a linked VNet resolves the office-only record through the approved target DNS servers.

Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. However, the option would implement create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers; the scenario instead requires configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. The differentiating evidence is that a client in a linked VNet resolves the office-only record through the approved target DNS servers.

Public Azure DNS zones and private DNS zones have different visibility and delegation semantics. However, the option would implement plan internal private DNS zones and public DNS hosting as distinct authoritative resolution scopes; the scenario instead requires configure a DNS Private Resolver outbound endpoint with a forwarding ruleset for the on-premises suffix. The differentiating evidence is that a client in a linked VNet resolves the office-only record through the approved target DNS servers.

A DDoS plan or protection policy only helps resources properly associated within its supported scope. However, the option would implement inventory DDoS protection plan associations and protected public IP resources in governance checks; the scenario instead requires use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends. The differentiating evidence is that the view shows a time-aligned degradation on the affected connection and recovery after the fix.

Connection troubleshoot evaluates the actual source-to-destination path rather than guessing from VM health status. However, the option would implement use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes; the scenario instead requires use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends. The differentiating evidence is that the view shows a time-aligned degradation on the affected connection and recovery after the fix.

Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. However, the option would implement use Defender for Cloud Cloud Security Explorer to query related security posture resources; the scenario instead requires use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends. The differentiating evidence is that the view shows a time-aligned degradation on the affected connection and recovery after the fix.

Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. However, the option would implement configure Microsoft peering only for eligible services and with the required prefix authorization and route filters; the scenario instead requires deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit. The differentiating evidence is that the VNet connection reports success and an app reaches its private on-premises destination.

Circuit health and private peering do not guarantee a workload selects that route over more specific UDR entries. However, the option would implement inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection; the scenario instead requires deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit. The differentiating evidence is that the VNet connection reports success and an app reaches its private on-premises destination.

ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. However, the option would implement select an ExpressRoute SKU and connectivity design that supports the needed geographic reach; the scenario instead requires deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit. The differentiating evidence is that the VNet connection reports success and an app reaches its private on-premises destination.