An HTTP-to-HTTPS redirect moves the client to a TLS endpoint rather than serving sensitive content over HTTP. However, the option would implement configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway; the scenario instead requires configure supported internal and public frontend IP configurations and bind listeners to the intended frontend. The differentiating evidence is that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. However, the option would implement add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing; the scenario instead requires configure supported internal and public frontend IP configurations and bind listeners to the intended frontend. The differentiating evidence is that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. However, the option would implement enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings; the scenario instead requires configure supported internal and public frontend IP configurations and bind listeners to the intended frontend. The differentiating evidence is that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

That observation would primarily validate another control: enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. BGP distributes network prefixes across compatible VPN peers, avoiding repeated manual network updates. The situation calls for evidence that the migration workload retains the expected address behavior and communicates within supported scope.

That observation would primarily validate another control: choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed. Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. The situation calls for evidence that the migration workload retains the expected address behavior and communicates within supported scope.

That observation would primarily validate another control: deploy a route-based Azure VPN gateway and matching site-to-site IPsec tunnels to the supported on-premises VPN device. A site-to-site Azure VPN gateway forms encrypted network-to-network IPsec tunnels over Internet transport. The situation calls for evidence that the migration workload retains the expected address behavior and communicates within supported scope.

VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. However, the option would implement enable supported VNet flow logs with the intended storage and analysis configuration; the scenario instead requires compare Network Watcher effective routes and effective security rules for the affected NIC. The differentiating evidence is that the intended destination prefix and matching NSG allow action are visible before the application probe passes.

Backend availability depends on probe reachability and network/security rules, not simply process existence. However, the option would implement inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing; the scenario instead requires compare Network Watcher effective routes and effective security rules for the affected NIC. The differentiating evidence is that the intended destination prefix and matching NSG allow action are visible before the application probe passes.

Connection troubleshoot evaluates the actual source-to-destination path rather than guessing from VM health status. However, the option would implement use Network Watcher Connection troubleshoot to inspect reachability, hops and network causes; the scenario instead requires compare Network Watcher effective routes and effective security rules for the affected NIC. The differentiating evidence is that the intended destination prefix and matching NSG allow action are visible before the application probe passes.

BGP distributes network prefixes across compatible VPN peers, avoiding repeated manual network updates. However, the option would implement enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements; the scenario instead requires select a supported VPN gateway SKU meeting tunnel counts, throughput, BGP and resiliency requirements. The differentiating evidence is that gateway metrics under a representative load remain within capacity and redundant branch paths stay connected.

Identical local and remote prefixes make destination routing ambiguous across a site-to-site tunnel. However, the option would implement resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S; the scenario instead requires select a supported VPN gateway SKU meeting tunnel counts, throughput, BGP and resiliency requirements. The differentiating evidence is that gateway metrics under a representative load remain within capacity and redundant branch paths stay connected.

Route-based and policy-based VPN designs have different peer capabilities and SKU support constraints. However, the option would implement choose a supported VPN gateway and policy-based configuration or upgrade the incompatible peer as needed; the scenario instead requires select a supported VPN gateway SKU meeting tunnel counts, throughput, BGP and resiliency requirements. The differentiating evidence is that gateway metrics under a representative load remain within capacity and redundant branch paths stay connected.

Both subnet and NIC security groups participate in evaluating traffic, so one permissive rule is insufficient. However, the option would implement check effective NSG rules at both subnet and network-interface levels and reconcile conflicting policies; the scenario instead requires associate the NSG with the actual target subnet or network interface and validate effective policy. The differentiating evidence is that the target NIC shows expected effective rules and an authorized allow/deny test confirms enforcement.

Priority and network scope determine whether an explicit source-block rule matches before broad allows. However, the option would implement create a scoped high-priority inbound NSG deny for the hostile source prefix at intended enforcement points; the scenario instead requires associate the NSG with the actual target subnet or network interface and validate effective policy. The differentiating evidence is that the target NIC shows expected effective rules and an authorized allow/deny test confirms enforcement.

IP-prefix and application security group membership determine which NSG rules match relocated workloads. However, the option would implement update NSG source or ASG membership for the new workload placement after validating its identity; the scenario instead requires associate the NSG with the actual target subnet or network interface and validate effective policy. The differentiating evidence is that the target NIC shows expected effective rules and an authorized allow/deny test confirms enforcement.

That observation would primarily validate another control: deploy a Virtual WAN user VPN gateway and appropriate P2S authentication and client configuration. Virtual WAN supports user VPN gateways for individually authenticated client connectivity. The situation calls for evidence that an authorized branch-to-spoke and hub-to-hub test follows the expected managed routing path.

That observation would primarily validate another control: configure route propagation from the branch connection into the spoke's associated route table. Virtual hub route-table propagation determines which connection prefixes are visible to each subscriber. The situation calls for evidence that an authorized branch-to-spoke and hub-to-hub test follows the expected managed routing path.

That observation would primarily validate another control: choose the appropriate Virtual WAN hub gateway scale units and capacity parameters. Different Virtual WAN gateway types have configurable scale units and supported limits. The situation calls for evidence that an authorized branch-to-spoke and hub-to-hub test follows the expected managed routing path.

That observation would primarily validate another control: configure appropriate Load Balancer probe and rollout health gating for backend readiness. Probe-driven backend health prevents new flows from being distributed to failing endpoints. The situation calls for evidence that a controlled region outage directs a new eligible client flow to a healthy regional backend.

That observation would primarily validate another control: register eligible NIC IP configurations or supported resources in the load balancer backend pool. Load balancing applies only to members registered in its backend pool and passing health checks. The situation calls for evidence that a controlled region outage directs a new eligible client flow to a healthy regional backend.

That observation would primarily validate another control: use Gateway Load Balancer and a supported transparent NVA service-chain configuration. Gateway Load Balancer integrates compatible NVAs into traffic flow without application-layer URL routing. The situation calls for evidence that a controlled region outage directs a new eligible client flow to a healthy regional backend.

Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. However, the option would implement attach a supported Application Gateway WAF policy in the intended enforcement mode; the scenario instead requires configure an Application Gateway redirect configuration associated with the right listener or rule. The differentiating evidence is that a client requesting the old path receives the correct redirect status and destination URL.

Rewrite rules modify supported HTTP header and URL aspects without requiring changes in every backend service. However, the option would implement configure an Application Gateway rewrite rule set matching the required request or response conditions; the scenario instead requires configure an Application Gateway redirect configuration associated with the right listener or rule. The differentiating evidence is that a client requesting the old path receives the correct redirect status and destination URL.

Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. However, the option would implement enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings; the scenario instead requires configure an Application Gateway redirect configuration associated with the right listener or rule. The differentiating evidence is that a client requesting the old path receives the correct redirect status and destination URL.

Effective NSG evaluation identifies the allow or deny rule governing a specific flow. However, the option would implement use Network Watcher IP flow verify or effective security rules for the exact source/destination tuple; the scenario instead requires review Defender for Cloud Secure Score security recommendations for network resources. The differentiating evidence is that the corrected resource recommendation clears after reassessment and its score contribution updates.

Healthy connection resources do not prove application reachability across security and routing boundaries. However, the option would implement use Network Watcher connectivity testing and route diagnostics from a representative Azure source; the scenario instead requires review Defender for Cloud Secure Score security recommendations for network resources. The differentiating evidence is that the corrected resource recommendation clears after reassessment and its score contribution updates.

Time-series health signals and actionable alert thresholds provide earlier detection than manual portal checks. However, the option would implement set Azure Monitor network health alerts and relevant performance thresholds for the monitored connection; the scenario instead requires review Defender for Cloud Secure Score security recommendations for network resources. The differentiating evidence is that the corrected resource recommendation clears after reassessment and its score contribution updates.

That observation would primarily validate another control: provide separate approved private endpoints for each consumer to the shared eligible Private Link service. A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. The situation calls for evidence that the connection status shows approved and the authorized client completes the expected service handshake.

That observation would primarily validate another control: use individual approved private endpoint connections and enforce data-plane identity authorization. DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. The situation calls for evidence that the connection status shows approved and the authorized client completes the expected service handshake.

That observation would primarily validate another control: require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. Connection approval separates consumer endpoint provisioning from provider authorization. The situation calls for evidence that the connection status shows approved and the authorized client completes the expected service handshake.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS. The differentiating evidence is that a datacenter client resolves the private IP and accesses the resource over the private link path.

A private endpoint presents a consumer-local IP while the provider service remains independent of consumer address ranges. However, the option would implement provide separate approved private endpoints for each consumer to the shared eligible Private Link service; the scenario instead requires route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS. The differentiating evidence is that a datacenter client resolves the private IP and accesses the resource over the private link path.

Private Link endpoint creation does not guarantee client DNS queries return the private IP. However, the option would implement link the correct service-specific private DNS zone to the client VNet and verify A-record resolution; the scenario instead requires route the datacenter to the private endpoint IP through supported hybrid connectivity and configure hybrid DNS. The differentiating evidence is that a datacenter client resolves the private IP and accesses the resource over the private link path.