Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. However, the option would implement configure Microsoft peering only for eligible services and with the required prefix authorization and route filters; the scenario instead requires deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit. The differentiating evidence is that the VNet connection reports success and an app reaches its private on-premises destination.

Circuit health and private peering do not guarantee a workload selects that route over more specific UDR entries. However, the option would implement inspect ExpressRoute BGP propagation, effective routes and UDR priority to restore correct path selection; the scenario instead requires deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit. The differentiating evidence is that the VNet connection reports success and an app reaches its private on-premises destination.

ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. However, the option would implement select an ExpressRoute SKU and connectivity design that supports the needed geographic reach; the scenario instead requires deploy a compatible ExpressRoute virtual network gateway and create the VNet connection to the circuit. The differentiating evidence is that the VNet connection reports success and an app reaches its private on-premises destination.

That observation would primarily validate another control: assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply. Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. The situation calls for evidence that a newly advertised test branch prefix appears in Azure learned routes and is reachable.

That observation would primarily validate another control: check gateway connection diagnostics, BGP learned routes and the relevant effective subnet routes. Tunnel control-plane status and Azure data-plane next-hop selection are separate conditions. The situation calls for evidence that a newly advertised test branch prefix appears in Azure learned routes and is reachable.

That observation would primarily validate another control: align IPsec/IKE proposals, key lifetimes and authentication settings at both ends of the VPN. IKE and IPsec security associations require mutually supported algorithms and consistent peer parameters. The situation calls for evidence that a newly advertised test branch prefix appears in Azure learned routes and is reachable.

Performance routing maps DNS clients to suitable regional endpoints using the Traffic Manager performance model. However, the option would implement use Traffic Manager Performance routing with enabled healthy endpoints; the scenario instead requires use Gateway Load Balancer and a supported transparent NVA service-chain configuration. The differentiating evidence is that an approved connection traverses the appliance and appears in inspection logs before reaching the backend.

Weighted Traffic Manager policies influence DNS answer distribution across eligible healthy endpoints. However, the option would implement configure Traffic Manager Weighted routing across the regional endpoints; the scenario instead requires use Gateway Load Balancer and a supported transparent NVA service-chain configuration. The differentiating evidence is that an approved connection traverses the appliance and appears in inspection logs before reaching the backend.

High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. However, the option would implement configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules; the scenario instead requires use Gateway Load Balancer and a supported transparent NVA service-chain configuration. The differentiating evidence is that an approved connection traverses the appliance and appears in inspection logs before reaching the backend.

VPN authentication alone does not install all required routes to remote interconnected networks. However, the option would implement review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes; the scenario instead requires select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication. The differentiating evidence is that a permitted user signs in with the intended Entra policy and a rejected identity fails access.

Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. However, the option would implement assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment; the scenario instead requires select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication. The differentiating evidence is that a permitted user signs in with the intended Entra policy and a rejected identity fails access.

RADIUS authentication depends on an accessible server and consistent protocol/authentication configuration. However, the option would implement configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets; the scenario instead requires select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication. The differentiating evidence is that a permitted user signs in with the intended Entra policy and a rejected identity fails access.

Both subnet and NIC security groups participate in evaluating traffic, so one permissive rule is insufficient. However, the option would implement check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies; the scenario instead requires create an application security group and reference it in supported NSG rules for member network interfaces. The differentiating evidence is that new member NICs receive expected traffic treatment and a nonmember remains excluded.

Outbound client-initiated traffic and unsolicited inbound sessions are separate NSG directions. However, the option would implement configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules; the scenario instead requires create an application security group and reference it in supported NSG rules for member network interfaces. The differentiating evidence is that new member NICs receive expected traffic treatment and a nonmember remains excluded.

NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. However, the option would implement correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering; the scenario instead requires create an application security group and reference it in supported NSG rules for member network interfaces. The differentiating evidence is that new member NICs receive expected traffic treatment and a nonmember remains excluded.

That observation would primarily validate another control: deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy. Secured virtual hubs support managed firewall enforcement for connected traffic when routing is configured. The situation calls for evidence that authorized dependencies remain functional while representative prohibited destinations are denied.

That observation would primarily validate another control: send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. The situation calls for evidence that authorized dependencies remain functional while representative prohibited destinations are denied.

That observation would primarily validate another control: deploy Azure Firewall into a supported hub and route workload egress through its private IP. Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. The situation calls for evidence that authorized dependencies remain functional while representative prohibited destinations are denied.

That observation would primarily validate another control: place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets. Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. The situation calls for evidence that the validated custom prefix reaches the commissioned state and allocated resource IPs are in the owned block.

That observation would primarily validate another control: add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. The situation calls for evidence that the validated custom prefix reaches the commissioned state and allocated resource IPs are in the owned block.

That observation would primarily validate another control: create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services. Gateway, Bastion, Firewall, private endpoint and application delivery components require space and specific subnet planning. The situation calls for evidence that the validated custom prefix reaches the commissioned state and allocated resource IPs are in the owned block.

That observation would primarily validate another control: correlate firewall decision logs with source and destination effective routes and return connectivity. A rule allow is not sufficient when a request or response never passes the expected firewall path. The situation calls for evidence that both intended firewalls report the applied policy version and enforce the same representative test rule.

That observation would primarily validate another control: create an Azure Firewall application rule scoped to the required FQDN and protocol. Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. The situation calls for evidence that both intended firewalls report the applied policy version and enforce the same representative test rule.

That observation would primarily validate another control: use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. Hierarchical policies provide centralized baselines while allowing controlled local additions. The situation calls for evidence that both intended firewalls report the applied policy version and enforce the same representative test rule.

That observation would primarily validate another control: use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. The situation calls for evidence that a packet trace and log entry identify the failing layer and the corrected flow succeeds both directions.

That observation would primarily validate another control: use supported Azure Firewall FQDN tags or service-aware policy features where applicable. Managed service and FQDN tags reduce brittle static destination-IP maintenance for supported services. The situation calls for evidence that a packet trace and log entry identify the failing layer and the corrected flow succeeds both directions.

That observation would primarily validate another control: send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. The situation calls for evidence that a packet trace and log entry identify the failing layer and the corrected flow succeeds both directions.

Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. However, the option would implement use a private endpoint instead of a service endpoint for private-IP service access; the scenario instead requires apply supported service endpoint policies with the authorized storage resource definitions. The differentiating evidence is that allowed storage accesses succeed while attempts toward an unapproved account are blocked.

Service endpoint traffic is governed by virtual network identity and service firewall rules. However, the option would implement review service endpoint behavior and update the target service's VNet network rules rather than relying only on public egress IPs; the scenario instead requires apply supported service endpoint policies with the authorized storage resource definitions. The differentiating evidence is that allowed storage accesses succeed while attempts toward an unapproved account are blocked.

Service endpoints are configured at subnet level, not automatically across an entire VNet. However, the option would implement enable the supported service endpoint on each specific subnet that requires the Azure service network identity; the scenario instead requires apply supported service endpoint policies with the authorized storage resource definitions. The differentiating evidence is that allowed storage accesses succeed while attempts toward an unapproved account are blocked.

That observation would primarily validate another control: create Front Door rules for supported redirect or URL rewrite behavior on the matching route. Front Door rules can modify edge request handling before forwarding to origin services. The situation calls for evidence that repeated public asset requests show cache hits while authenticated account responses are not cached.

That observation would primarily validate another control: approve the required private endpoint connection and verify the origin's private link health. Private Link origin connectivity requires accepted connection state and valid private endpoint/DNS behavior. The situation calls for evidence that repeated public asset requests show cache hits while authenticated account responses are not cached.

That observation would primarily validate another control: create specific Front Door routes matching the intended domain and path patterns to origin groups. A route connects domain/path matching with the origin group and forwarding behavior. The situation calls for evidence that repeated public asset requests show cache hits while authenticated account responses are not cached.