NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. However, the option would implement attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet; the scenario instead requires use Azure Route Server with a supported BGP peer to exchange routes dynamically. The differentiating evidence is that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

Azure forwarding selects longest matching prefixes before route-source precedence for equal-prefix routes. However, the option would implement inspect the effective-route longest-prefix match and add the proper more-specific route where supported; the scenario instead requires use Azure Route Server with a supported BGP peer to exchange routes dynamically. The differentiating evidence is that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

Control-plane connectivity and data-plane path selection must be diagnosed separately. However, the option would implement inspect peering status, route propagation and effective routes before changing security policies; the scenario instead requires use Azure Route Server with a supported BGP peer to exchange routes dynamically. The differentiating evidence is that learned prefixes appear in effective routes and a newly advertised test prefix becomes reachable.

That observation would primarily validate another control: sequence private endpoint approval, private DNS, connectivity testing and then public network restriction. Disabling the public endpoint before validating private name resolution and routes can cause an avoidable outage. The situation calls for evidence that each consumer connects through its assigned local private address without overlapping network route conflicts.

That observation would primarily validate another control: publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints. Private Link service exposes a provider-hosted private service to consumer private endpoints. The situation calls for evidence that each consumer connects through its assigned local private address without overlapping network route conflicts.

That observation would primarily validate another control: check resource-specific Private Link support, subresource group IDs and regional availability before implementation. Private endpoint connectivity depends on the destination service's supported private link capabilities. The situation calls for evidence that each consumer connects through its assigned local private address without overlapping network route conflicts.

A working BGP control plane does not guarantee the desired next hop when route tables override propagated paths. However, the option would implement compare effective routes and correct the conflicting UDR or route-propagation setting; the scenario instead requires attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet. The differentiating evidence is that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

UDRs affect only subnets to which their route table is associated. However, the option would implement associate the intended route table with every subnet that must use that UDR policy; the scenario instead requires attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet. The differentiating evidence is that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

Stateful firewalls need consistent bidirectional session visibility or supported asymmetric-flow handling. However, the option would implement validate symmetric request and return routes through the stateful inspection appliance; the scenario instead requires attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet. The differentiating evidence is that external tests observe the NAT public IPs and connection metrics remain below exhaustion thresholds.

That observation would primarily validate another control: align Application Gateway backend host-name and health-probe configuration with the origin virtual host. Layer-7 backend routing and TLS validation depend on the host and protocol settings. The situation calls for evidence that gateway capacity increases within configured limits and response/error metrics remain within target thresholds.

That observation would primarily validate another control: configure appropriate multi-site listeners and host-based routing rules on Application Gateway. Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. The situation calls for evidence that gateway capacity increases within configured limits and response/error metrics remain within target thresholds.

That observation would primarily validate another control: move the gateway into a supported dedicated subnet with adequate addresses for expected scaling. Application Gateway has subnet placement and IP capacity requirements distinct from backend pools. The situation calls for evidence that gateway capacity increases within configured limits and response/error metrics remain within target thresholds.

Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. However, the option would implement create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet; the scenario instead requires associate a supported static public IP resource with the correct VM network interface configuration. The differentiating evidence is that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

Peering and hybrid routing require unambiguous destinations; overlapping prefixes prevent intended reachability. However, the option would implement allocate unique nonoverlapping private address spaces for each VNet and plan growth before establishing connectivity; the scenario instead requires associate a supported static public IP resource with the correct VM network interface configuration. The differentiating evidence is that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

Reproducible network definitions and validation catch overlapping or noncompliant ranges before live peering. However, the option would implement define address and segmentation standards in IaC with governance checks before production deployment; the scenario instead requires associate a supported static public IP resource with the correct VM network interface configuration. The differentiating evidence is that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

That observation would primarily validate another control: choose the appropriate Virtual WAN hub gateway scale units and capacity parameters. Different Virtual WAN gateway types have configurable scale units and supported limits. The situation calls for evidence that an approved risky connection triggers the configured firewall rule while permitted test traffic passes.

That observation would primarily validate another control: deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies. Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. The situation calls for evidence that an approved risky connection triggers the configured firewall rule while permitted test traffic passes.

That observation would primarily validate another control: check Standard Virtual WAN hub-to-hub connectivity and effective routes for both regions. Virtual WAN hub interconnect and route propagation control cross-region VNet path availability. The situation calls for evidence that an approved risky connection triggers the configured firewall rule while permitted test traffic passes.

That observation would primarily validate another control: associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns. Front Door WAF evaluates incoming HTTP requests at the edge before routing to origins. The situation calls for evidence that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

That observation would primarily validate another control: apply supported origin access restrictions using Front Door identification and approved security controls. Public origins need defenses against clients bypassing edge WAF and delivery rules. The situation calls for evidence that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

That observation would primarily validate another control: configure an appropriate lightweight unauthenticated Front Door origin health probe path. Edge origin health assessment should use a consistently reachable probe without costly application side effects. The situation calls for evidence that a test from permitted geography reaches the intended endpoint while a restricted test follows policy.

A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. However, the option would implement update local network gateway address spaces or validated BGP advertisements for the missing prefix; the scenario instead requires deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. The differentiating evidence is that the tunnel status is connected and representative branch subnets reach the approved Azure prefixes.

Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. However, the option would implement assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply; the scenario instead requires deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. The differentiating evidence is that the tunnel status is connected and representative branch subnets reach the approved Azure prefixes.

Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. However, the option would implement update the local network gateway resource with the remote VPN device public IP and correct prefixes; the scenario instead requires deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. The differentiating evidence is that the tunnel status is connected and representative branch subnets reach the approved Azure prefixes.

Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. However, the option would implement create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet; the scenario instead requires plan address-space updates with peering synchronization and dependency validation before routing cutover. The differentiating evidence is that updated effective routes reflect the new prefixes and representative traffic works before old addresses are removed.

Some platform integrations require subnet delegation and cannot coexist with arbitrary resources in that subnet. However, the option would implement create an eligible dedicated subnet and apply the delegation required by the integrating Azure service; the scenario instead requires plan address-space updates with peering synchronization and dependency validation before routing cutover. The differentiating evidence is that updated effective routes reflect the new prefixes and representative traffic works before old addresses are removed.

IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. However, the option would implement add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends; the scenario instead requires plan address-space updates with peering synchronization and dependency validation before routing cutover. The differentiating evidence is that updated effective routes reflect the new prefixes and representative traffic works before old addresses are removed.

That observation would primarily validate another control: attach a supported Application Gateway WAF policy in the intended enforcement mode. Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. The situation calls for evidence that gateway capacity increases within configured limits and response/error metrics remain within target thresholds.

That observation would primarily validate another control: configure an Application Gateway redirect configuration associated with the right listener or rule. HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. The situation calls for evidence that gateway capacity increases within configured limits and response/error metrics remain within target thresholds.

That observation would primarily validate another control: configure a custom Application Gateway health probe with the correct host header, protocol and probe path. Gateway backend health uses probe settings that must match the application's listener and host expectations. The situation calls for evidence that gateway capacity increases within configured limits and response/error metrics remain within target thresholds.

HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. However, the option would implement configure an Application Gateway redirect configuration associated with the right listener or rule; the scenario instead requires add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. The differentiating evidence is that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. However, the option would implement attach a supported Application Gateway WAF policy in the intended enforcement mode; the scenario instead requires add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. The differentiating evidence is that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

URL path maps select backend targets on HTTP path matches, with default behavior for other paths. However, the option would implement configure path-based routing rules and suitable default backend pool in Application Gateway; the scenario instead requires add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. The differentiating evidence is that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.