NSGs do not replace application-aware firewall decisions and firewall rules do not work when bypassed. However, the option would implement combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth; the scenario instead requires use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. The differentiating evidence is that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. The differentiating evidence is that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. However, the option would implement create an Azure Firewall application rule scoped to the required FQDN and protocol; the scenario instead requires use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. The differentiating evidence is that a prohibited flow stays blocked under child policies and an approved application-specific rule is applied.

That observation would primarily validate another control: configure supported P2S RADIUS authentication with reachable RADIUS servers and matching shared secrets. RADIUS authentication depends on an accessible server and consistent protocol/authentication configuration. The situation calls for evidence that the supported Windows host establishes the expected private management path to the target VM.

That observation would primarily validate another control: select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication. Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. The situation calls for evidence that the supported Windows host establishes the expected private management path to the target VM.

That observation would primarily validate another control: provide suitable DNS servers and private-zone forwarding settings in the P2S client configuration. P2S connection establishes reachability but private DNS lookup depends on client and gateway DNS settings. The situation calls for evidence that the supported Windows host establishes the expected private management path to the target VM.

ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. However, the option would implement select an ExpressRoute SKU and connectivity design that supports the needed geographic reach; the scenario instead requires add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate. The differentiating evidence is that an approved packet inspection or tunnel check confirms encryption on the required connection segment.

FastPath can improve the data path for supported ExpressRoute configurations by bypassing the gateway dataplane. However, the option would implement enable ExpressRoute FastPath on compatible circuits, gateways and network resources; the scenario instead requires add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate. The differentiating evidence is that an approved packet inspection or tunnel check confirms encryption on the required connection segment.

Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. However, the option would implement configure Microsoft peering only for eligible services and with the required prefix authorization and route filters; the scenario instead requires add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate. The differentiating evidence is that an approved packet inspection or tunnel check confirms encryption on the required connection segment.

User-defined routes direct selected prefixes through a network virtual appliance when transparent inspection is required. However, the option would implement associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop; the scenario instead requires enable appropriate forwarded traffic settings on the relevant peering connections and retain correct return routes. The differentiating evidence is that cross-spoke traffic is forwarded through the appliance with matching request and return packets.

A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. However, the option would implement respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists; the scenario instead requires enable appropriate forwarded traffic settings on the relevant peering connections and retain correct return routes. The differentiating evidence is that cross-spoke traffic is forwarded through the appliance with matching request and return packets.

UDRs affect only subnets to which their route table is associated. However, the option would implement associate the intended route table with every subnet that must use that UDR policy; the scenario instead requires enable appropriate forwarded traffic settings on the relevant peering connections and retain correct return routes. The differentiating evidence is that cross-spoke traffic is forwarded through the appliance with matching request and return packets.

Direct VNet peering does not resolve overlapping address-space ambiguity. However, the option would implement renumber overlapping VNet address spaces before peering or design a supported translation boundary; the scenario instead requires associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop. The differentiating evidence is that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. However, the option would implement respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists; the scenario instead requires associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop. The differentiating evidence is that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. However, the option would implement review effective routes and keep the explicit appliance route when inspected forced tunneling is required; the scenario instead requires associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop. The differentiating evidence is that effective routes for the source NIC show the appliance next hop and a test connection is logged on the inspection device.

Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. However, the option would implement publish only the eligible Private Link service target with appropriate access policy rather than VNet peering; the scenario instead requires verify the service's VNet integration outbound route and private DNS configuration in the integration environment. The differentiating evidence is that a request from the actual integrated service resolves the endpoint privately and completes the database query.

Private endpoint policy support and traffic paths must be consistent with the desired inspection/segmentation design. However, the option would implement review and configure supported private endpoint network policies and the associated subnet routes deliberately; the scenario instead requires verify the service's VNet integration outbound route and private DNS configuration in the integration environment. The differentiating evidence is that a request from the actual integrated service resolves the endpoint privately and completes the database query.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires verify the service's VNet integration outbound route and private DNS configuration in the integration environment. The differentiating evidence is that a request from the actual integrated service resolves the endpoint privately and completes the database query.

Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. However, the option would implement enable autoregistration for the appropriate VNet link to an Azure Private DNS zone; the scenario instead requires create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs. The differentiating evidence is that an approved VM resolves the service FQDN to the private endpoint address and connects privately.

Inbound Private Resolver resolves private zones available through its network's DNS resolution context. However, the option would implement link the private zone to the inbound resolver's VNet or otherwise provide a valid resolution path; the scenario instead requires create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs. The differentiating evidence is that an approved VM resolves the service FQDN to the private endpoint address and connects privately.

DNS caching can delay a record change independently of network route availability. However, the option would implement reduce record TTL before a planned migration and validate propagation and client cache expiry; the scenario instead requires create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs. The differentiating evidence is that an approved VM resolves the service FQDN to the private endpoint address and connects privately.

That observation would primarily validate another control: configure appropriate multi-site listeners and host-based routing rules on Application Gateway. Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. The situation calls for evidence that a client requesting the old path receives the correct redirect status and destination URL.

That observation would primarily validate another control: move the gateway into a supported dedicated subnet with adequate addresses for expected scaling. Application Gateway has subnet placement and IP capacity requirements distinct from backend pools. The situation calls for evidence that a client requesting the old path receives the correct redirect status and destination URL.

That observation would primarily validate another control: configure path-based routing rules and suitable default backend pool in Application Gateway. URL path maps select backend targets on HTTP path matches, with default behavior for other paths. The situation calls for evidence that a client requesting the old path receives the correct redirect status and destination URL.

DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. However, the option would implement adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design; the scenario instead requires use Traffic Manager Performance routing with enabled healthy endpoints. The differentiating evidence is that queries from separated test locations resolve to the expected healthy regional endpoint under the policy.

Load Balancer health probes decide which backends are eligible for new flows. However, the option would implement configure an eligible health probe and backend listener that match the service port and NSG rules; the scenario instead requires use Traffic Manager Performance routing with enabled healthy endpoints. The differentiating evidence is that queries from separated test locations resolve to the expected healthy regional endpoint under the policy.

Gateway Load Balancer integrates compatible NVAs into traffic flow without application-layer URL routing. However, the option would implement use Gateway Load Balancer and a supported transparent NVA service-chain configuration; the scenario instead requires use Traffic Manager Performance routing with enabled healthy endpoints. The differentiating evidence is that queries from separated test locations resolve to the expected healthy regional endpoint under the policy.

Virtual hub route-table propagation determines which connection prefixes are visible to each subscriber. However, the option would implement configure route propagation from the branch connection into the spoke's associated route table; the scenario instead requires design Virtual WAN traffic security explicitly with compatible firewall and routing features. The differentiating evidence is that an approved risky connection triggers the configured firewall rule while permitted test traffic passes.

Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. However, the option would implement deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies; the scenario instead requires design Virtual WAN traffic security explicitly with compatible firewall and routing features. The differentiating evidence is that an approved risky connection triggers the configured firewall rule while permitted test traffic passes.

Different Virtual WAN gateway types have configurable scale units and supported limits. However, the option would implement choose the appropriate Virtual WAN hub gateway scale units and capacity parameters; the scenario instead requires design Virtual WAN traffic security explicitly with compatible firewall and routing features. The differentiating evidence is that an approved risky connection triggers the configured firewall rule while permitted test traffic passes.

That observation would primarily validate another control: enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. The situation calls for evidence that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

That observation would primarily validate another control: configure appropriate multi-site listeners and host-based routing rules on Application Gateway. Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. The situation calls for evidence that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

That observation would primarily validate another control: configure a custom Application Gateway health probe with the correct host header, protocol and probe path. Gateway backend health uses probe settings that must match the application's listener and host expectations. The situation calls for evidence that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.