That observation would primarily validate another control: constrain client routing and enforce destination access with NSGs and identity-aware controls. P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. The situation calls for evidence that a freshly configured client imports the new profile and reaches the expected VNet resources.

That observation would primarily validate another control: choose a gateway-supported tunnel type compatible with the target operating systems and approved client software. P2S tunnel protocol support varies by gateway settings and VPN client platform. The situation calls for evidence that a freshly configured client imports the new profile and reaches the expected VNet resources.

That observation would primarily validate another control: assign a distinct nonoverlapping P2S client address pool and republish the client configuration. Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. The situation calls for evidence that a freshly configured client imports the new profile and reaches the expected VNet resources.

That observation would primarily validate another control: combine service endpoint network rules with proper service authentication and RBAC or access policies. Network allow lists and data-plane authorization are independent controls. The situation calls for evidence that requests from enabled subnets match intended service rules; an unconfigured subnet remains excluded.

That observation would primarily validate another control: allow the intended service-tag destination and necessary outbound flow in subnet security controls. Service endpoint routing does not bypass independent NSG or resource firewall enforcement. The situation calls for evidence that requests from enabled subnets match intended service rules; an unconfigured subnet remains excluded.

That observation would primarily validate another control: enable an appropriate virtual network service endpoint and allow the subnet in the service firewall. Service endpoints extend VNet identity to supported Azure services while service traffic uses the service's public endpoint. The situation calls for evidence that requests from enabled subnets match intended service rules; an unconfigured subnet remains excluded.

That observation would primarily validate another control: resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S. Identical local and remote prefixes make destination routing ambiguous across a site-to-site tunnel. The situation calls for evidence that the selected gateway instance scales successfully and its associated VPN remains healthy.

That observation would primarily validate another control: design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. Internet-bound branch traffic requires explicit default-route propagation and a compatible secured hub path. The situation calls for evidence that the selected gateway instance scales successfully and its associated VPN remains healthy.

That observation would primarily validate another control: update local network gateway address spaces or validated BGP advertisements for the missing prefix. A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. The situation calls for evidence that the selected gateway instance scales successfully and its associated VPN remains healthy.

That observation would primarily validate another control: link the correct service-specific private DNS zone to the client VNet and verify A-record resolution. Private Link endpoint creation does not guarantee client DNS queries return the private IP. The situation calls for evidence that a permitted identity in an approved network succeeds and a denied identity or network cannot perform the protected operation.

That observation would primarily validate another control: restrict or disable the PaaS resource's public network access separately from creating its private endpoint. Private endpoints do not necessarily disable a service's existing public network endpoint automatically. The situation calls for evidence that a permitted identity in an approved network succeeds and a denied identity or network cannot perform the protected operation.

That observation would primarily validate another control: approve the intended private endpoint connection on the target resource before testing access. Some Private Link connections require resource-owner approval before private traffic is accepted. The situation calls for evidence that a permitted identity in an approved network succeeds and a denied identity or network cannot perform the protected operation.

High outbound connection concurrency needs sufficient SNAT ports and a deliberate egress configuration. However, the option would implement configure an explicit supported outbound strategy using NAT Gateway or load balancer outbound rules; the scenario instead requires register eligible NIC IP configurations or supported resources in the load balancer backend pool. The differentiating evidence is that both registered healthy instances receive requests under an observed distribution sample.

Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. However, the option would implement use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing; the scenario instead requires register eligible NIC IP configurations or supported resources in the load balancer backend pool. The differentiating evidence is that both registered healthy instances receive requests under an observed distribution sample.

DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. However, the option would implement adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design; the scenario instead requires register eligible NIC IP configurations or supported resources in the load balancer backend pool. The differentiating evidence is that both registered healthy instances receive requests under an observed distribution sample.

That observation would primarily validate another control: design an explicit routed transit path using an NVA or supported hub routing architecture. VNet peering is not intrinsically transitive; a route or gateway strategy is required for spoke-to-spoke transit. The situation calls for evidence that a test from a permitted hub path succeeds while a prohibited direct spoke-to-spoke path is absent.

That observation would primarily validate another control: compare effective routes and correct the conflicting UDR or route-propagation setting. A working BGP control plane does not guarantee the desired next hop when route tables override propagated paths. The situation calls for evidence that a test from a permitted hub path succeeds while a prohibited direct spoke-to-spoke path is absent.

That observation would primarily validate another control: use Azure Virtual Network Manager connectivity configurations and appropriate network groups. Virtual Network Manager can centrally deploy topology and network connectivity configurations across scoped VNets. The situation calls for evidence that a test from a permitted hub path succeeds while a prohibited direct spoke-to-spoke path is absent.

That observation would primarily validate another control: start the WAF in detection mode, review matched rules and then enable prevention after tuning. Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. The situation calls for evidence that a safe attack-like HTTP request matches WAF rules while a normal TLS request reaches the application.

That observation would primarily validate another control: associate the WAF policy to the intended Application Gateway scope, listener or route as supported. A standalone policy object does not inspect traffic until attached to an applicable gateway scope. The situation calls for evidence that a safe attack-like HTTP request matches WAF rules while a normal TLS request reaches the application.

That observation would primarily validate another control: scope and associate appropriate WAF security policies to supported domains or path patterns. WAF policy association and custom rule match conditions determine where application-layer controls apply. The situation calls for evidence that a safe attack-like HTTP request matches WAF rules while a normal TLS request reaches the application.

That observation would primarily validate another control: define address and segmentation standards in IaC with governance checks before production deployment. Reproducible network definitions and validation catch overlapping or noncompliant ranges before live peering. The situation calls for evidence that the documented address plan has no overlap and effective routes deliver packets to the intended VNet or site.

That observation would primarily validate another control: create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services. Gateway, Bastion, Firewall, private endpoint and application delivery components require space and specific subnet planning. The situation calls for evidence that the documented address plan has no overlap and effective routes deliver packets to the intended VNet or site.

That observation would primarily validate another control: add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends. IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. The situation calls for evidence that the documented address plan has no overlap and effective routes deliver packets to the intended VNet or site.

Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. However, the option would implement configure hub gateway transit and enable use of remote gateways on the eligible spoke peering; the scenario instead requires deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. The differentiating evidence is that a drift check identifies an unauthorized default route and an approved template restores the intended path.

User-defined routes direct selected prefixes through a network virtual appliance when transparent inspection is required. However, the option would implement associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop; the scenario instead requires deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. The differentiating evidence is that a drift check identifies an unauthorized default route and an approved template restores the intended path.

Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. However, the option would implement inspect the effective-route longest-prefix match and add the proper more-specific route where supported; the scenario instead requires deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. The differentiating evidence is that a drift check identifies an unauthorized default route and an approved template restores the intended path.

Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. However, the option would implement inspect the effective-route longest-prefix match and add the proper more-specific route where supported; the scenario instead requires respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. The differentiating evidence is that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. However, the option would implement attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet; the scenario instead requires respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. The differentiating evidence is that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. However, the option would implement review effective routes and keep the explicit appliance route when inspected forced tunneling is required; the scenario instead requires respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists. The differentiating evidence is that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

That observation would primarily validate another control: combine service endpoint network rules with proper service authentication and RBAC or access policies. Network allow lists and data-plane authorization are independent controls. The situation calls for evidence that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

That observation would primarily validate another control: apply supported service endpoint policies with the authorized storage resource definitions. Service endpoint policies can narrow egress to supported Azure service resources rather than all accounts. The situation calls for evidence that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.

That observation would primarily validate another control: add the selected VNet/subnet to the target service's virtual network access rules. Service endpoint enablement alone does not grant access at the PaaS service network policy layer. The situation calls for evidence that a targeted permitted storage request succeeds and unrelated denied egress continues to be blocked.