Cloud exchange, point-to-point and other provider models have different operational and physical requirements. However, the option would implement choose an ExpressRoute connectivity model matching the provider handoff, location and circuit provisioning; the scenario instead requires provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. The differentiating evidence is that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

ExpressRoute reachability depends on the prefixes exchanged through established peering sessions. However, the option would implement correct BGP route advertisements and filters so the desired prefixes propagate in both directions; the scenario instead requires provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. The differentiating evidence is that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

Different failure domains require independently provisioned connectivity, not just dual paths within one circuit. However, the option would implement design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections; the scenario instead requires provision an ExpressRoute circuit with a supported connectivity provider and Azure private peering. The differentiating evidence is that the circuit is provisioned, BGP private peering is established and authorized VNet traffic traverses the circuit.

That observation would primarily validate another control: deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy. Secured virtual hubs support managed firewall enforcement for connected traffic when routing is configured. The situation calls for evidence that an external test reaches only the published internal service and unrelated ports remain inaccessible.

That observation would primarily validate another control: associate the required UDR and validate effective routes across every protected workload subnet. Azure Firewall cannot inspect flows that routing directs around its data path. The situation calls for evidence that an external test reaches only the published internal service and unrelated ports remain inaccessible.

That observation would primarily validate another control: send Azure Firewall resource logs and metrics to an approved Log Analytics workspace or monitoring destination. Firewall decision evidence must be collected and retained; policy resources alone do not create searchable history. The situation calls for evidence that an external test reaches only the published internal service and unrelated ports remain inaccessible.

That observation would primarily validate another control: configure P2S root certificate trust and issue valid client certificates from the approved CA. Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. The situation calls for evidence that a test user approved by RADIUS connects and a deliberately invalid credential is rejected.

That observation would primarily validate another control: assign a distinct nonoverlapping P2S client address pool and republish the client configuration. Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. The situation calls for evidence that a test user approved by RADIUS connects and a deliberately invalid credential is rejected.

That observation would primarily validate another control: assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. The situation calls for evidence that a test user approved by RADIUS connects and a deliberately invalid credential is rejected.

That observation would primarily validate another control: allocate a Public IP Prefix and create supported public IP resources from that prefix. Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. The situation calls for evidence that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

That observation would primarily validate another control: create AzureBastionSubnet with a supported prefix and deploy Azure Bastion to that dedicated subnet. Azure Bastion requires its named dedicated subnet and provides managed connectivity to VMs over their private IPs. The situation calls for evidence that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

That observation would primarily validate another control: provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway. Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. The situation calls for evidence that the NIC resolves to the reserved public address and an authorized restricted inbound connection reaches the host.

That observation would primarily validate another control: configure path-based routing rules and suitable default backend pool in Application Gateway. URL path maps select backend targets on HTTP path matches, with default behavior for other paths. The situation calls for evidence that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

That observation would primarily validate another control: move the gateway into a supported dedicated subnet with adequate addresses for expected scaling. Application Gateway has subnet placement and IP capacity requirements distinct from backend pools. The situation calls for evidence that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

That observation would primarily validate another control: attach a supported Application Gateway WAF policy in the intended enforcement mode. Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. The situation calls for evidence that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

Priority and network scope determine whether an explicit source-block rule matches before broad allows. However, the option would implement create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points; the scenario instead requires inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. The differentiating evidence is that the tool identifies the actual rule and the targeted test behaves correctly after remediation.

Outbound client-initiated traffic and unsolicited inbound sessions are separate NSG directions. However, the option would implement configure narrow outbound HTTPS permissions instead of unnecessary inbound allow rules; the scenario instead requires inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. The differentiating evidence is that the tool identifies the actual rule and the targeted test behaves correctly after remediation.

Azure service tags abstract changing Azure service address ranges in network security rules. However, the option would implement use the appropriate Azure service tag for supported NSG destination restrictions; the scenario instead requires inspect effective security rules and IP flow verify for the exact source, destination, protocol and port. The differentiating evidence is that the tool identifies the actual rule and the targeted test behaves correctly after remediation.

Correct name resolution does not create connectivity; routing, firewall and endpoint access still matter. However, the option would implement validate DNS resolution separately from IP routing and provide an approved private network path; the scenario instead requires create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints. The differentiating evidence is that both endpoint resources provision successfully into separate delegated subnets without subnet constraint failures.

Private Link connectivity commonly depends on the appropriate privatelink DNS zone and VNet link. However, the option would implement create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs; the scenario instead requires create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints. The differentiating evidence is that both endpoint resources provision successfully into separate delegated subnets without subnet constraint failures.

Custom DNS configuration can bypass Azure-provided private-zone resolution unless appropriate forwarding is configured. However, the option would implement add explicit conditional forwarding from custom DNS to a resolver able to answer the private-zone namespace; the scenario instead requires create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints. The differentiating evidence is that both endpoint resources provision successfully into separate delegated subnets without subnet constraint failures.

That observation would primarily validate another control: use supported Bidirectional Forwarding Detection with a compatible ExpressRoute peering configuration. BFD can detect forwarding failures rapidly and inform BGP convergence where supported. The situation calls for evidence that the BGP session reaches established state and correct advertised routes are visible.

That observation would primarily validate another control: select an ExpressRoute SKU and connectivity design that supports the needed geographic reach. ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. The situation calls for evidence that the BGP session reaches established state and correct advertised routes are visible.

That observation would primarily validate another control: configure Microsoft peering only for eligible services and with the required prefix authorization and route filters. Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. The situation calls for evidence that the BGP session reaches established state and correct advertised routes are visible.

NAT Gateway is the managed subnet-level SNAT option for predictable outbound public IPs without inbound publishing. However, the option would implement attach Azure NAT Gateway with sufficient public IP capacity to the relevant outbound subnet; the scenario instead requires validate symmetric request and return routes through the stateful inspection appliance. The differentiating evidence is that packet captures on both sides show request and response traversing the expected inspection point.

Route Server exchanges BGP information with compatible appliances and Azure networking instead of relying on static edits. However, the option would implement use Azure Route Server with a supported BGP peer to exchange routes dynamically; the scenario instead requires validate symmetric request and return routes through the stateful inspection appliance. The differentiating evidence is that packet captures on both sides show request and response traversing the expected inspection point.

Subnet NAT Gateway supplies outbound-only address translation without creating VM public listeners. However, the option would implement place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs; the scenario instead requires validate symmetric request and return routes through the stateful inspection appliance. The differentiating evidence is that packet captures on both sides show request and response traversing the expected inspection point.

That observation would primarily validate another control: deploy an Azure DNS Private Resolver inbound endpoint and point on-premises conditional forwarding at its IP. The inbound endpoint accepts hybrid DNS queries and can resolve private zones linked to its VNet. The situation calls for evidence that the branch resolves the correct private IP and a protocol-level connection succeeds over the authorized route.

That observation would primarily validate another control: create appropriate public-zone A records for IPv4 and MX records for mail routing. DNS record types have distinct purposes: A provides IPv4 host resolution while MX selects mail exchangers. The situation calls for evidence that the branch resolves the correct private IP and a protocol-level connection succeeds over the authorized route.

That observation would primarily validate another control: create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs. Private Link connectivity commonly depends on the appropriate privatelink DNS zone and VNet link. The situation calls for evidence that the branch resolves the correct private IP and a protocol-level connection succeeds over the authorized route.

Gateway backend health uses probe settings that must match the application's listener and host expectations. However, the option would implement configure a custom Application Gateway health probe with the correct host header, protocol and probe path; the scenario instead requires configure path-based routing rules and suitable default backend pool in Application Gateway. The differentiating evidence is that an /api request and an unrelated path are served by the expected separate pools.

Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. However, the option would implement configure appropriate multi-site listeners and host-based routing rules on Application Gateway; the scenario instead requires configure path-based routing rules and suitable default backend pool in Application Gateway. The differentiating evidence is that an /api request and an unrelated path are served by the expected separate pools.

Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. However, the option would implement replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener; the scenario instead requires configure path-based routing rules and suitable default backend pool in Application Gateway. The differentiating evidence is that an /api request and an unrelated path are served by the expected separate pools.