Gateway backend health uses probe settings that must match the application's listener and host expectations. However, the option would implement configure a custom Application Gateway health probe with the correct host header, protocol and probe path; the scenario instead requires configure path-based routing rules and suitable default backend pool in Application Gateway. The differentiating evidence is that an /api request and an unrelated path are served by the expected separate pools.

Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. However, the option would implement configure appropriate multi-site listeners and host-based routing rules on Application Gateway; the scenario instead requires configure path-based routing rules and suitable default backend pool in Application Gateway. The differentiating evidence is that an /api request and an unrelated path are served by the expected separate pools.

Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. However, the option would implement replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener; the scenario instead requires configure path-based routing rules and suitable default backend pool in Application Gateway. The differentiating evidence is that an /api request and an unrelated path are served by the expected separate pools.

That observation would primarily validate another control: configure P2S root certificate trust and issue valid client certificates from the approved CA. Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. The situation calls for evidence that gateway metrics show adequate capacity and the test client remains connected under a representative load.

That observation would primarily validate another control: assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. The situation calls for evidence that gateway metrics show adequate capacity and the test client remains connected under a representative load.

That observation would primarily validate another control: validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration. Always On VPN is a client-side management design with specific tunnel and infrastructure requirements. The situation calls for evidence that gateway metrics show adequate capacity and the test client remains connected under a representative load.

Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. However, the option would implement reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility; the scenario instead requires define address and segmentation standards in IaC with governance checks before production deployment. The differentiating evidence is that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

Gateway, Bastion, Firewall, private endpoint and application delivery components require space and specific subnet planning. However, the option would implement create an expandable CIDR and subnet capacity plan that reserves room for gateway and security services; the scenario instead requires define address and segmentation standards in IaC with governance checks before production deployment. The differentiating evidence is that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

VNet subnets define address boundaries where NSGs and route tables can enforce different connectivity policies. However, the option would implement create purpose-specific subnets in the VNet and apply matching network security and routing controls; the scenario instead requires define address and segmentation standards in IaC with governance checks before production deployment. The differentiating evidence is that a test deployment outside the allowed CIDR policy fails and compliant VNets provision with the intended ranges.

That observation would primarily validate another control: choose a supported service endpoint where the requirement is subnet-based restriction rather than private addressing. Service endpoints provide VNet-based PaaS firewall restrictions without deploying private endpoint NICs. The situation calls for evidence that the target service accepts the specified subnet and logs show requests attributed to the allowed source network.

That observation would primarily validate another control: use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required. A service endpoint is a VNet subnet property and does not directly make arbitrary branch source IPs part of that subnet. The situation calls for evidence that the target service accepts the specified subnet and logs show requests attributed to the allowed source network.

That observation would primarily validate another control: allow the intended service-tag destination and necessary outbound flow in subnet security controls. Service endpoint routing does not bypass independent NSG or resource firewall enforcement. The situation calls for evidence that the target service accepts the specified subnet and logs show requests attributed to the allowed source network.

That observation would primarily validate another control: update the local network gateway resource with the remote VPN device public IP and correct prefixes. Azure uses the local network gateway to represent remote VPN peer addressing and advertised network space. The situation calls for evidence that branch clients reach the spoke prefix and the spoke effective route uses the hub's remote gateway.

That observation would primarily validate another control: update local network gateway address spaces or validated BGP advertisements for the missing prefix. A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. The situation calls for evidence that branch clients reach the spoke prefix and the spoke effective route uses the hub's remote gateway.

That observation would primarily validate another control: assess Azure Extended Network requirements and deploy it only where the supported migration constraints apply. Azure Extended Network is a specialized subnet extension option, not a replacement for ordinary routed S2S connectivity. The situation calls for evidence that branch clients reach the spoke prefix and the spoke effective route uses the hub's remote gateway.

Microsoft peering is distinct from Azure private peering and has service-specific routing requirements. However, the option would implement configure Microsoft peering only for eligible services and with the required prefix authorization and route filters; the scenario instead requires design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections. The differentiating evidence is that a controlled primary-path outage retains a functional alternate route for the required workload.

FastPath can improve the data path for supported ExpressRoute configurations by bypassing the gateway dataplane. However, the option would implement enable ExpressRoute FastPath on compatible circuits, gateways and network resources; the scenario instead requires design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections. The differentiating evidence is that a controlled primary-path outage retains a functional alternate route for the required workload.

ExpressRoute SKU and tier influence geographic connectivity capabilities and supported use cases. However, the option would implement select an ExpressRoute SKU and connectivity design that supports the needed geographic reach; the scenario instead requires design ExpressRoute redundancy across appropriate circuits, peering locations and VNet connections. The differentiating evidence is that a controlled primary-path outage retains a functional alternate route for the required workload.

That observation would primarily validate another control: select Azure Firewall Premium and configure supported TLS inspection and IDPS settings. Advanced IDPS and TLS inspection are Premium capabilities and require certificate and policy planning. The situation calls for evidence that the intended Azure service stays reachable after endpoint changes without permitting unrelated public destinations.

That observation would primarily validate another control: deploy Azure Firewall in a secured virtual hub with appropriate routing intent and Firewall Policy. Secured virtual hubs support managed firewall enforcement for connected traffic when routing is configured. The situation calls for evidence that the intended Azure service stays reachable after endpoint changes without permitting unrelated public destinations.

That observation would primarily validate another control: configure a DNAT rule with the intended public destination, private target and matching security controls. Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. The situation calls for evidence that the intended Azure service stays reachable after endpoint changes without permitting unrelated public destinations.

WAF custom rate limits and bot controls can mitigate application-layer request floods when correctly scoped. However, the option would implement configure supported WAF rate-limit or bot protection rules at the appropriate edge scope; the scenario instead requires limit WAF exclusions to the smallest required match variable, field or rule. The differentiating evidence is that the legitimate header passes and a representative attack in unrelated fields remains detected.

Two WAF enforcement points can both inspect requests; policy coordination reduces conflicting false positives. However, the option would implement define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers; the scenario instead requires limit WAF exclusions to the smallest required match variable, field or rule. The differentiating evidence is that the legitimate header passes and a representative attack in unrelated fields remains detected.

Detection mode logs rule matches without blocking requests, supporting controlled policy tuning. However, the option would implement start the WAF in detection mode, review matched rules and then enable prevention after tuning; the scenario instead requires limit WAF exclusions to the smallest required match variable, field or rule. The differentiating evidence is that the legitimate header passes and a representative attack in unrelated fields remains detected.

That observation would primarily validate another control: configure a DNAT rule with the intended public destination, private target and matching security controls. Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. The situation calls for evidence that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

That observation would primarily validate another control: use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. The situation calls for evidence that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

That observation would primarily validate another control: enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering. FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. The situation calls for evidence that the approved TCP connection succeeds and an unapproved port between the same hosts is blocked.

That observation would primarily validate another control: configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates. The client-to-edge and edge-to-origin TLS connections are distinct and must both be configured. The situation calls for evidence that origin health remains stable and a controlled failure results in expected traffic diversion.

That observation would primarily validate another control: configure Front Door origin-group health probes and suitable priority or weight settings. Front Door origin selection depends on health probes and configured origin priority or weight. The situation calls for evidence that origin health remains stable and a controlled failure results in expected traffic diversion.

That observation would primarily validate another control: approve the required private endpoint connection and verify the origin's private link health. Private Link origin connectivity requires accepted connection state and valid private endpoint/DNS behavior. The situation calls for evidence that origin health remains stable and a controlled failure results in expected traffic diversion.

That observation would primarily validate another control: review effective routes and keep the explicit appliance route when inspected forced tunneling is required. A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. The situation calls for evidence that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

That observation would primarily validate another control: associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop. User-defined routes direct selected prefixes through a network virtual appliance when transparent inspection is required. The situation calls for evidence that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

That observation would primarily validate another control: configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. The situation calls for evidence that the intended group members receive consistent managed connectivity and test paths follow the declared topology.