That observation would primarily validate another control: validate Azure-supported Always On VPN requirements and select compatible VPN gateway and client configuration. Always On VPN is a client-side management design with specific tunnel and infrastructure requirements. The situation calls for evidence that clients on approved platforms negotiate the selected tunnel and connect to the allowed subnet.

That observation would primarily validate another control: review P2S route advertisement, gateway transit and return-route support for the hybrid prefixes. VPN authentication alone does not install all required routes to remote interconnected networks. The situation calls for evidence that clients on approved platforms negotiate the selected tunnel and connect to the allowed subnet.

That observation would primarily validate another control: constrain client routing and enforce destination access with NSGs and identity-aware controls. P2S provides network transport; least-privilege access still depends on explicit destination security enforcement. The situation calls for evidence that clients on approved platforms negotiate the selected tunnel and connect to the allowed subnet.

That observation would primarily validate another control: use a Private Link service with explicit connection approval and supported provider NAT configuration. A provider Private Link service can expose eligible private load-balanced workloads to consumer subscriptions. The situation calls for evidence that a representative approved flow reaches the endpoint through the intended path and denied flows are blocked.

That observation would primarily validate another control: use individual approved private endpoint connections and enforce data-plane identity authorization. DNS visibility is not resource authorization; Private Link approval and service-level permissions are separate. The situation calls for evidence that a representative approved flow reaches the endpoint through the intended path and denied flows are blocked.

That observation would primarily validate another control: sequence private endpoint approval, private DNS, connectivity testing and then public network restriction. Disabling the public endpoint before validating private name resolution and routes can cause an avoidable outage. The situation calls for evidence that a representative approved flow reaches the endpoint through the intended path and denied flows are blocked.

That observation would primarily validate another control: use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance. Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. The situation calls for evidence that a sample denied FQDN is blocked at Azure Firewall while subnet NSG rules continue enforcing local segmentation.

That observation would primarily validate another control: create an Azure Firewall application rule scoped to the required FQDN and protocol. Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. The situation calls for evidence that a sample denied FQDN is blocked at Azure Firewall while subnet NSG rules continue enforcing local segmentation.

That observation would primarily validate another control: replace blanket allows with least-privilege application and network rule collections. Central inspection is effective only if the policy meaningfully restricts destination and transport access. The situation calls for evidence that a sample denied FQDN is blocked at Azure Firewall while subnet NSG rules continue enforcing local segmentation.

That observation would primarily validate another control: associate a route table with a UDR pointing the intended destination prefix to the virtual appliance next hop. User-defined routes direct selected prefixes through a network virtual appliance when transparent inspection is required. The situation calls for evidence that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

That observation would primarily validate another control: place a NAT Gateway on the private workload subnet and remove unnecessary VM public IPs. Subnet NAT Gateway supplies outbound-only address translation without creating VM public listeners. The situation calls for evidence that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

That observation would primarily validate another control: deploy route tables and peering through reviewed IaC with Azure Policy checks on allowed configurations. Centralized change definitions make route and topology deviations detectable before deployment. The situation calls for evidence that peering configuration validates and the intended on-premises routes are present without gateway-use conflicts.

That observation would primarily validate another control: inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls. P2S gateway SKU limits and client tunnel health are distinct from account credential validity. The situation calls for evidence that a test user approved by RADIUS connects and a deliberately invalid credential is rejected.

That observation would primarily validate another control: assess Azure Network Adapter's supported Windows VPN use case and prerequisites before deployment. Azure Network Adapter is a host-oriented option and is not equivalent to a whole-site S2S connection. The situation calls for evidence that a test user approved by RADIUS connects and a deliberately invalid credential is rejected.

That observation would primarily validate another control: configure P2S root certificate trust and issue valid client certificates from the approved CA. Certificate-based P2S authentication requires gateway trusted roots and correctly issued client certificates. The situation calls for evidence that a test user approved by RADIUS connects and a deliberately invalid credential is rejected.

Service endpoints retain the service public endpoint, whereas Private Link provides a private endpoint IP. However, the option would implement use a private endpoint instead of a service endpoint for private-IP service access; the scenario instead requires combine service endpoint network rules with proper service authentication and RBAC or access policies. The differentiating evidence is that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

Service endpoints do not change a service FQDN into a consumer private endpoint address. However, the option would implement keep normal public service DNS and validate service endpoint route and subnet network-rule behavior; the scenario instead requires combine service endpoint network rules with proper service authentication and RBAC or access policies. The differentiating evidence is that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

A service endpoint is a VNet subnet property and does not directly make arbitrary branch source IPs part of that subnet. However, the option would implement use Private Link with supported hybrid DNS and connectivity when on-premises private endpoint access is required; the scenario instead requires combine service endpoint network rules with proper service authentication and RBAC or access policies. The differentiating evidence is that an authorized user on the subnet can read approved data while an unauthorized identity is denied.

That observation would primarily validate another control: assign a distinct nonoverlapping P2S client address pool and republish the client configuration. Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. The situation calls for evidence that the revoked client fails authentication while a valid approved certificate still connects.

That observation would primarily validate another control: select a supported OpenVPN-based P2S configuration with Microsoft Entra ID authentication. Entra ID authentication for Azure VPN P2S is associated with supported OpenVPN and client combinations. The situation calls for evidence that the revoked client fails authentication while a valid approved certificate still connects.

That observation would primarily validate another control: regenerate and distribute the appropriate Azure VPN client configuration profile after gateway changes. Client settings must match the endpoint, routes and auth mode configured on the gateway. The situation calls for evidence that the revoked client fails authentication while a valid approved certificate still connects.

That observation would primarily validate another control: configure an Application Gateway rewrite rule set matching the required request or response conditions. Rewrite rules modify supported HTTP header and URL aspects without requiring changes in every backend service. The situation calls for evidence that an approved safe test payload produces a matching WAF log action without blocking normal transactions.

That observation would primarily validate another control: enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. The situation calls for evidence that an approved safe test payload produces a matching WAF log action without blocking normal transactions.

That observation would primarily validate another control: add an appropriate global edge delivery architecture such as Azure Front Door for multi-region routing. Application Gateway primarily provides regional layer-7 ingress, while Front Door supplies global edge entry and acceleration. The situation calls for evidence that an approved safe test payload produces a matching WAF log action without blocking normal transactions.

DNS-layer policy can block known malicious domains without treating an IP firewall allow rule as DNS security. However, the option would implement apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope; the scenario instead requires remove a self-referential forwarding ruleset link or rule to prevent a resolver forwarding loop. The differentiating evidence is that a trace of a controlled lookup shows one resolution path without recursive forwarding or timeout.

Public Azure DNS zones and private DNS zones have different visibility and delegation semantics. However, the option would implement plan internal private DNS zones and public DNS hosting as distinct authoritative resolution scopes; the scenario instead requires remove a self-referential forwarding ruleset link or rule to prevent a resolver forwarding loop. The differentiating evidence is that a trace of a controlled lookup shows one resolution path without recursive forwarding or timeout.

Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. However, the option would implement enable autoregistration for the appropriate VNet link to an Azure Private DNS zone; the scenario instead requires remove a self-referential forwarding ruleset link or rule to prevent a resolver forwarding loop. The differentiating evidence is that a trace of a controlled lookup shows one resolution path without recursive forwarding or timeout.

Layer-7 backend routing and TLS validation depend on the host and protocol settings. However, the option would implement align Application Gateway backend host-name and health-probe configuration with the origin virtual host; the scenario instead requires move the gateway into a supported dedicated subnet with adequate addresses for expected scaling. The differentiating evidence is that gateway deployment and scale-out succeed while backend instances remain in approved separate subnets.

Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. However, the option would implement configure appropriate multi-site listeners and host-based routing rules on Application Gateway; the scenario instead requires move the gateway into a supported dedicated subnet with adequate addresses for expected scaling. The differentiating evidence is that gateway deployment and scale-out succeed while backend instances remain in approved separate subnets.

Gateway backend health uses probe settings that must match the application's listener and host expectations. However, the option would implement configure a custom Application Gateway health probe with the correct host header, protocol and probe path; the scenario instead requires move the gateway into a supported dedicated subnet with adequate addresses for expected scaling. The differentiating evidence is that gateway deployment and scale-out succeed while backend instances remain in approved separate subnets.

Healthy connection resources do not prove application reachability across security and routing boundaries. However, the option would implement use Network Watcher connectivity testing and route diagnostics from a representative Azure source; the scenario instead requires inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. The differentiating evidence is that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

Collecting network flows is useful only if relevant logs reach an authorized searchable destination. However, the option would implement route VNet flow telemetry into supported storage or traffic analytics with access and retention controls; the scenario instead requires inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. The differentiating evidence is that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

VPN disconnect and gateway events require historical telemetry, not only current status views. However, the option would implement collect virtual network gateway diagnostic logs and metrics into centralized monitoring; the scenario instead requires inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. The differentiating evidence is that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.