That observation would primarily validate another control: review effective routes and keep the explicit appliance route when inspected forced tunneling is required. A default UDR to an NVA or gateway can take routing precedence over subnet NAT Gateway egress. The situation calls for evidence that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

That observation would primarily validate another control: associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop. User-defined routes direct selected prefixes through a network virtual appliance when transparent inspection is required. The situation calls for evidence that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

That observation would primarily validate another control: configure hub gateway transit and enable use of remote gateways on the eligible spoke peering. Gateway transit allows a peered VNet to consume an eligible gateway in another VNet under peering constraints. The situation calls for evidence that the intended group members receive consistent managed connectivity and test paths follow the declared topology.

Private endpoints can serve on-premises clients when DNS and private routing to the VNet are established. However, the option would implement route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS; the scenario instead requires sequence private endpoint approval, private DNS, connectivity testing and then public network restriction. The differentiating evidence is that the application passes private-path tests before public ingress is disabled and stays healthy afterward.

Private endpoints map a supported PaaS service into a VNet through a private network interface. However, the option would implement create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration; the scenario instead requires sequence private endpoint approval, private DNS, connectivity testing and then public network restriction. The differentiating evidence is that the application passes private-path tests before public ingress is disabled and stays healthy afterward.

A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. However, the option would implement provide separate approved private endpoints for each consumer to the shared eligible Private Link service; the scenario instead requires sequence private endpoint approval, private DNS, connectivity testing and then public network restriction. The differentiating evidence is that the application passes private-path tests before public ingress is disabled and stays healthy afterward.

Azure virtual network gateways use a reserved GatewaySubnet; shared workload placement is unsupported. However, the option would implement provision a dedicated GatewaySubnet sized for the chosen VPN or ExpressRoute gateway; the scenario instead requires reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility. The differentiating evidence is that both endpoints receive private addresses and approved clients connect using the corresponding endpoint records.

IPv6 reachability requires explicit address space, subnet and resource support, not a public DNS AAAA record alone. However, the option would implement add a supported IPv6 address space and configure dual-stack subnets and compatible resource front ends; the scenario instead requires reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility. The differentiating evidence is that both endpoints receive private addresses and approved clients connect using the corresponding endpoint records.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility. The differentiating evidence is that both endpoints receive private addresses and approved clients connect using the corresponding endpoint records.

That observation would primarily validate another control: design Virtual WAN traffic security explicitly with compatible firewall and routing features. Virtual WAN provides connectivity; inspecting traffic requires a separate supported security design. The situation calls for evidence that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

That observation would primarily validate another control: use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation. Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. The situation calls for evidence that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

That observation would primarily validate another control: correct Virtual WAN route table associations and propagation labels for the connected networks. Virtual hub routing depends on the association and propagation configuration of each connection. The situation calls for evidence that a permitted cross-region flow follows the intended hub path and is returned symmetrically.

Azure service tags abstract changing Azure service address ranges in network security rules. However, the option would implement use the appropriate Azure service tag for supported NSG destination restrictions; the scenario instead requires create an application security group and reference it in supported NSG rules for member network interfaces. The differentiating evidence is that new member NICs receive expected traffic treatment and a nonmember remains excluded.

Default NSG rules can permit outbound traffic unless a custom restrictive policy overrides them. However, the option would implement create higher-priority outbound deny and narrowly scoped allow rules consistent with the planned egress route; the scenario instead requires create an application security group and reference it in supported NSG rules for member network interfaces. The differentiating evidence is that new member NICs receive expected traffic treatment and a nonmember remains excluded.

Effective NSG evaluation can reveal a matching default or higher-priority rule overlooked in a template. However, the option would implement inspect effective security rules and IP flow verify for the exact source, destination, protocol and port; the scenario instead requires create an application security group and reference it in supported NSG rules for member network interfaces. The differentiating evidence is that new member NICs receive expected traffic treatment and a nonmember remains excluded.

Private endpoints map a supported PaaS service into a VNet through a private network interface. However, the option would implement create an Azure private endpoint for the supported PaaS resource and use the proper private DNS configuration; the scenario instead requires publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints. The differentiating evidence is that an approved consumer endpoint reaches the service while an unapproved connection remains denied.

DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. However, the option would implement use individual approved private endpoint connections and enforce data-plane identity authorization; the scenario instead requires publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints. The differentiating evidence is that an approved consumer endpoint reaches the service while an unapproved connection remains denied.

A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. However, the option would implement provide separate approved private endpoints for each consumer to the shared eligible Private Link service; the scenario instead requires publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints. The differentiating evidence is that an approved consumer endpoint reaches the service while an unapproved connection remains denied.

That observation would primarily validate another control: add the selected VNet/subnet to the target service's virtual network access rules. Service endpoint enablement alone does not grant access at the PaaS service network policy layer. The situation calls for evidence that dNS retains expected public service records while approved subnet access succeeds under the service firewall.

That observation would primarily validate another control: allow the intended service-tag destination and necessary outbound flow in subnet security controls. Service endpoint routing does not bypass independent NSG or resource firewall enforcement. The situation calls for evidence that dNS retains expected public service records while approved subnet access succeeds under the service firewall.

That observation would primarily validate another control: use a private endpoint instead of a service endpoint for private-IP service access. Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. The situation calls for evidence that dNS retains expected public service records while approved subnet access succeeds under the service firewall.

Healthy connection resources do not prove application reachability across security and routing boundaries. However, the option would implement use Network Watcher connectivity testing and route diagnostics from a representative Azure source; the scenario instead requires collect virtual network gateway diagnostic logs and metrics into centralized monitoring. The differentiating evidence is that the monitoring store shows timestamps and causes for a simulated or observed connection transition.

Collecting network flows is useful only if relevant logs reach an authorized searchable destination. However, the option would implement route VNet flow telemetry into supported storage or traffic analytics with access and retention controls; the scenario instead requires collect virtual network gateway diagnostic logs and metrics into centralized monitoring. The differentiating evidence is that the monitoring store shows timestamps and causes for a simulated or observed connection transition.

Backend availability depends on probe reachability and network/security rules, not simply process existence. However, the option would implement inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing; the scenario instead requires collect virtual network gateway diagnostic logs and metrics into centralized monitoring. The differentiating evidence is that the monitoring store shows timestamps and causes for a simulated or observed connection transition.

That observation would primarily validate another control: deploy Azure Firewall into a supported hub and route workload egress through its private IP. Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. The situation calls for evidence that the firewall provisions successfully and its health and data-plane traffic meet deployment checks.

That observation would primarily validate another control: configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination. Network rules are appropriate for transport and IP-address traffic that is not evaluated as HTTP hostnames. The situation calls for evidence that the firewall provisions successfully and its health and data-plane traffic meet deployment checks.

That observation would primarily validate another control: configure a DNAT rule with the intended public destination, private target and matching security controls. Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. The situation calls for evidence that the firewall provisions successfully and its health and data-plane traffic meet deployment checks.

That observation would primarily validate another control: adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design. DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. The situation calls for evidence that traffic to each required transport port reaches healthy backend members according to expected flow distribution.

That observation would primarily validate another control: deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes. Public Load Balancer distributes layer-4 flows across healthy backends without inspecting URL paths. The situation calls for evidence that traffic to each required transport port reaches healthy backend members according to expected flow distribution.

That observation would primarily validate another control: configure Traffic Manager Weighted routing across the regional endpoints. Weighted Traffic Manager policies influence DNS answer distribution across eligible healthy endpoints. The situation calls for evidence that traffic to each required transport port reaches healthy backend members according to expected flow distribution.

That observation would primarily validate another control: use Network Watcher connectivity testing and route diagnostics from a representative Azure source. Healthy connection resources do not prove application reachability across security and routing boundaries. The situation calls for evidence that the monitoring store shows timestamps and causes for a simulated or observed connection transition.

That observation would primarily validate another control: inventory DDoS protection plan associations and protected public IP resources in governance checks. A DDoS plan or protection policy only helps resources properly associated within its supported scope. The situation calls for evidence that the monitoring store shows timestamps and causes for a simulated or observed connection transition.

That observation would primarily validate another control: use Defender for Cloud Cloud Security Explorer to query related security posture resources. Cloud Security Explorer helps correlate resource attributes and security relationships at inventory scale. The situation calls for evidence that the monitoring store shows timestamps and causes for a simulated or observed connection transition.