HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. However, the option would implement configure an Application Gateway redirect configuration associated with the right listener or rule; the scenario instead requires add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. The differentiating evidence is that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. However, the option would implement attach a supported Application Gateway WAF policy in the intended enforcement mode; the scenario instead requires add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. The differentiating evidence is that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

URL path maps select backend targets on HTTP path matches, with default behavior for other paths. However, the option would implement configure path-based routing rules and suitable default backend pool in Application Gateway; the scenario instead requires add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. The differentiating evidence is that a test from multiple geographies reaches a healthy regional origin through the intended edge endpoint.

Virtual WAN supports specific managed NVA integrations and partner deployment requirements. However, the option would implement use a supported Virtual WAN integrated network virtual appliance offering and validate its routing model; the scenario instead requires deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings. The differentiating evidence is that branch tunnel resources connect and branch traffic reaches an approved linked VNet.

Virtual hub route-table propagation determines which connection prefixes are visible to each subscriber. However, the option would implement configure route propagation from the branch connection into the spoke's associated route table; the scenario instead requires deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings. The differentiating evidence is that branch tunnel resources connect and branch traffic reaches an approved linked VNet.

Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. However, the option would implement design Virtual WAN traffic security explicitly with compatible firewall and routing features; the scenario instead requires deploy a virtual hub site-to-site VPN gateway and attach branches using supported connection settings. The differentiating evidence is that branch tunnel resources connect and branch traffic reaches an approved linked VNet.

Service endpoint routing does not bypass independent NSG or resource firewall enforcement. However, the option would implement allow the intended service-tag destination and necessary outbound flow in subnet security controls; the scenario instead requires enable the supported service endpoint on each specific subnet that requires the Azure service network identity. The differentiating evidence is that requests from enabled subnets match intended service rules; an unconfigured subnet remains excluded.

Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. However, the option would implement use a private endpoint instead of a service endpoint for private-IP service access; the scenario instead requires enable the supported service endpoint on each specific subnet that requires the Azure service network identity. The differentiating evidence is that requests from enabled subnets match intended service rules; an unconfigured subnet remains excluded.

Service endpoint policies can narrow egress to supported Azure service resources rather than all accounts. However, the option would implement apply supported service endpoint policies with the authorized storage resource definitions; the scenario instead requires enable the supported service endpoint on each specific subnet that requires the Azure service network identity. The differentiating evidence is that requests from enabled subnets match intended service rules; an unconfigured subnet remains excluded.

VPN authentication alone does not install all required routes to remote interconnected networks. However, the option would implement review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes; the scenario instead requires revoke or deny the specific P2S client certificate by supported gateway configuration and policy. The differentiating evidence is that the revoked client fails authentication while a valid approved certificate still connects.

P2S gateway SKU limits and client tunnel health are distinct from account credential validity. However, the option would implement inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls; the scenario instead requires revoke or deny the specific P2S client certificate by supported gateway configuration and policy. The differentiating evidence is that the revoked client fails authentication while a valid approved certificate still connects.

Always On VPN is a client-side management design with specific tunnel and infrastructure requirements. However, the option would implement validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration; the scenario instead requires revoke or deny the specific P2S client certificate by supported gateway configuration and policy. The differentiating evidence is that the revoked client fails authentication while a valid approved certificate still connects.

That observation would primarily validate another control: require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. Connection approval separates consumer endpoint provisioning from provider authorization. The situation calls for evidence that the consumer reaches the authorized service endpoint but cannot route to unrelated provider subnet IPs.

That observation would primarily validate another control: use individual approved private endpoint connections and enforce data-plane identity authorization. DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. The situation calls for evidence that the consumer reaches the authorized service endpoint but cannot route to unrelated provider subnet IPs.

That observation would primarily validate another control: publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints. Private Link service exposes a provider-hosted private service to consumer private endpoints. The situation calls for evidence that the consumer reaches the authorized service endpoint but cannot route to unrelated provider subnet IPs.

That observation would primarily validate another control: use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. The situation calls for evidence that an external test reaches only the published internal service and unrelated ports remain inaccessible.

That observation would primarily validate another control: review Firewall Policy rule-collection-group and collection processing order and correct priorities. Azure Firewall policy evaluation order and processing rules determine which matching decision applies. The situation calls for evidence that an external test reaches only the published internal service and unrelated ports remain inaccessible.

That observation would primarily validate another control: use a supported parent-child Firewall Policy design with rule inheritance and delegated app policies. Hierarchical policies provide centralized baselines while allowing controlled local additions. The situation calls for evidence that an external test reaches only the published internal service and unrelated ports remain inaccessible.

A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. However, the option would implement provide separate approved private endpoints for each consumer to the shared eligible Private Link service; the scenario instead requires create the needed private endpoints and matching DNS zones for each required supported storage subresource. The differentiating evidence is that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

Some Private Link connections require resource-owner approval before private traffic is accepted. However, the option would implement approve the intended private endpoint connection on the target resource before testing access; the scenario instead requires create the needed private endpoints and matching DNS zones for each required supported storage subresource. The differentiating evidence is that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires create the needed private endpoints and matching DNS zones for each required supported storage subresource. The differentiating evidence is that both blob and file service FQDNs resolve to their respective private addresses and transactions succeed.

VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. However, the option would implement enable supported VNet flow logs with the intended storage and analysis configuration; the scenario instead requires set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection. The differentiating evidence is that a safe degraded-link test or monitored incident triggers the expected alert with affected resource context.

Attack path analysis evaluates connected weaknesses rather than treating each network setting in isolation. However, the option would implement use Defender for Cloud attack path analysis to identify exploitable exposure chains; the scenario instead requires set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection. The differentiating evidence is that a safe degraded-link test or monitored incident triggers the expected alert with affected resource context.

A DDoS plan or protection policy only helps resources properly associated within its supported scope. However, the option would implement inventory DDoS protection plan associations and protected public IP resources in governance checks; the scenario instead requires set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection. The differentiating evidence is that a safe degraded-link test or monitored incident triggers the expected alert with affected resource context.

A private transport path is not inherently end-to-end payload encryption for compliance purposes. However, the option would implement add application-level TLS, IPsec over ExpressRoute, or supported MACsec on eligible Direct ports as appropriate; the scenario instead requires match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters. The differentiating evidence is that the BGP session reaches established state and correct advertised routes are visible.

ExpressRoute provides private connectivity through a provider path, subject to service and circuit design. However, the option would implement provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering; the scenario instead requires match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters. The differentiating evidence is that the BGP session reaches established state and correct advertised routes are visible.

ExpressRoute reachability depends on the prefixes exchanged through established peering sessions. However, the option would implement correct BGP route advertisements and filters so the desired prefixes propagate in both directions; the scenario instead requires match ExpressRoute peering VLAN, ASN, BGP addressing and authorized session parameters. The differentiating evidence is that the BGP session reaches established state and correct advertised routes are visible.

Private Link connectivity commonly depends on the appropriate privatelink DNS zone and VNet link. However, the option would implement create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs; the scenario instead requires separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. The differentiating evidence is that the test VNet resolves the test target while a production VNet resolves its approved production target.

DNS-layer policy can block known malicious domains without treating an IP firewall allow rule as DNS security. However, the option would implement apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope; the scenario instead requires separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. The differentiating evidence is that the test VNet resolves the test target while a production VNet resolves its approved production target.

Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. However, the option would implement add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace; the scenario instead requires separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. The differentiating evidence is that the test VNet resolves the test target while a production VNet resolves its approved production target.

Cloud exchange, point-to-point and other provider models have different operational and physical requirements. However, the option would implement choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning; the scenario instead requires provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. The differentiating evidence is that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

ExpressRoute reachability depends on the prefixes exchanged through established peering sessions. However, the option would implement correct BGP route advertisements and filters so the desired prefixes propagate in both directions; the scenario instead requires provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. The differentiating evidence is that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. However, the option would implement design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections; the scenario instead requires provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. The differentiating evidence is that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.