Healthy connection resources do not prove application reachability across security and routing boundaries. However, the option would implement use Network Watcher connectivity testing and route diagnostics from a representative Azure source; the scenario instead requires inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. The differentiating evidence is that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

Collecting network flows is useful only if relevant logs reach an authorized searchable destination. However, the option would implement route VNet flow telemetry into supported storage or traffic analytics with access and retention controls; the scenario instead requires inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. The differentiating evidence is that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

VPN disconnect and gateway events require historical telemetry, not only current status views. However, the option would implement collect virtual network gateway diagnostic logs and metrics into centralized monitoring; the scenario instead requires inspect load balancer probe results and Network Watcher path diagnostics before changing VM sizing. The differentiating evidence is that after correcting the path, the backend transitions to healthy and a permitted client request succeeds.

DNS record types have distinct purposes: A provides IPv4 host resolution while MX selects mail exchangers. However, the option would implement create appropriate public-zone A records for IPv4 and MX records for mail routing; the scenario instead requires create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints. The differentiating evidence is that both endpoint resources provision successfully into separate delegated subnets without subnet constraint failures.

Name resolution visibility is determined by private-zone linking and namespace selection. However, the option would implement separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links; the scenario instead requires create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints. The differentiating evidence is that both endpoint resources provision successfully into separate delegated subnets without subnet constraint failures.

Private Link connectivity commonly depends on the appropriate privatelink DNS zone and VNet link. However, the option would implement create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs; the scenario instead requires create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints. The differentiating evidence is that both endpoint resources provision successfully into separate delegated subnets without subnet constraint failures.

That observation would primarily validate another control: attach Application Gateway WAF policy using current managed rules and an appropriate enforcement mode. WAF policies inspect HTTP application requests for known attack patterns rather than replacing NSG port controls. The situation calls for evidence that a controlled test shows the intended enforcement layer with consistent logged request identifiers.

That observation would primarily validate another control: change the tuned WAF policy to prevention mode and confirm the intended managed rule action. Prevention mode can block matching HTTP requests, while detection mode is nonblocking. The situation calls for evidence that a controlled test shows the intended enforcement layer with consistent logged request identifiers.

That observation would primarily validate another control: deploy a supported layer-7 WAF on Application Gateway or Front Door rather than relying solely on NSG port filters. NSGs enforce network transport rules and do not parse application attack payloads. The situation calls for evidence that a controlled test shows the intended enforcement layer with consistent logged request identifiers.

That observation would primarily validate another control: assign a distinct nonoverlapping P2S client address pool and republish the client configuration. Client source address conflicts cause ambiguous routing or failures despite a successful VPN handshake. The situation calls for evidence that a valid test client establishes the VPN while a certificate from an untrusted issuer is denied.

That observation would primarily validate another control: inspect P2S gateway capacity, tunnel counts and connection diagnostics before changing identity controls. P2S gateway SKU limits and client tunnel health are distinct from account credential validity. The situation calls for evidence that a valid test client establishes the VPN while a certificate from an untrusted issuer is denied.

That observation would primarily validate another control: configure Azure VPN Gateway point-to-site connectivity with an approved tunnel and client profile. Point-to-site VPN is designed for individual client devices rather than fixed network-to-network peer sites. The situation calls for evidence that a valid test client establishes the VPN while a certificate from an untrusted issuer is denied.

That observation would primarily validate another control: design supported forced tunneling and coordinated on-premises default-route and Azure firewall routing. Internet-bound branch traffic requires explicit default-route propagation and a compatible secured hub path. The situation calls for evidence that branch clients reach the spoke prefix and the spoke effective route uses the hub's remote gateway.

That observation would primarily validate another control: configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints. Active-active VPN gateway instances can provide redundant tunnel paths when peer devices support the design. The situation calls for evidence that branch clients reach the spoke prefix and the spoke effective route uses the hub's remote gateway.

That observation would primarily validate another control: enable BGP on a supported VPN gateway and configure matching BGP peers and route advertisements. BGP distributes network prefixes across compatible VPN peers, avoiding repeated manual network updates. The situation calls for evidence that branch clients reach the spoke prefix and the spoke effective route uses the hub's remote gateway.

That observation would primarily validate another control: require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. Connection approval separates consumer endpoint provisioning from provider authorization. The situation calls for evidence that a datacenter client resolves the private IP and accesses the resource over the private link path.

That observation would primarily validate another control: link the correct service-specific private DNS zone to the client VNet and verify A-record resolution. Private Link endpoint creation does not guarantee client DNS queries return the private IP. The situation calls for evidence that a datacenter client resolves the private IP and accesses the resource over the private link path.

That observation would primarily validate another control: publish only the eligible Private Link service target with appropriate access policy rather than VNet peering. Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. The situation calls for evidence that a datacenter client resolves the private IP and accesses the resource over the private link path.

A DDoS plan or protection policy only helps resources properly associated within its supported scope. However, the option would implement inventory DDoS protection plan associations and protected public IP resources in governance checks; the scenario instead requires use Defender for Cloud Cloud Security Explorer to query related security posture resources. The differentiating evidence is that the query returns the expected exposed resources and excludes remediated or out-of-scope assets.

DDoS protection must cover the public IP exposure and publish telemetry for mitigation assessment. However, the option would implement enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs; the scenario instead requires use Defender for Cloud Cloud Security Explorer to query related security posture resources. The differentiating evidence is that the query returns the expected exposed resources and excludes remediated or out-of-scope assets.

Aggregated network views connect resource health and relevant network signals for operations analysis. However, the option would implement use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends; the scenario instead requires use Defender for Cloud Cloud Security Explorer to query related security posture resources. The differentiating evidence is that the query returns the expected exposed resources and excludes remediated or out-of-scope assets.

VNet flow logs are the recommended replacement for new telemetry as NSG flow logs move toward retirement. However, the option would implement enable supported VNet flow logs with the intended storage and analysis configuration; the scenario instead requires collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes. The differentiating evidence is that the investigation reports the actual DNS target, path and application response and isolates the failed dependency.

Aggregated network views connect resource health and relevant network signals for operations analysis. However, the option would implement use Azure Monitor for Networks and relevant Network Watcher metrics to correlate network health trends; the scenario instead requires collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes. The differentiating evidence is that the investigation reports the actual DNS target, path and application response and isolates the failed dependency.

VPN disconnect and gateway events require historical telemetry, not only current status views. However, the option would implement collect virtual network gateway diagnostic logs and metrics into centralized monitoring; the scenario instead requires collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes. The differentiating evidence is that the investigation reports the actual DNS target, path and application response and isolates the failed dependency.

That observation would primarily validate another control: create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers. Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. The situation calls for evidence that on-premises nslookup against the conditional forwarder returns the expected Azure private address.

That observation would primarily validate another control: validate DNS resolution separately from IP routing and provide an approved private network path. Correct name resolution does not create connectivity; routing, firewall and endpoint access still matter. The situation calls for evidence that on-premises nslookup against the conditional forwarder returns the expected Azure private address.

That observation would primarily validate another control: plan internal private DNS zones and public DNS hosting as distinct authoritative resolution scopes. Public Azure DNS zones and private DNS zones have different visibility and delegation semantics. The situation calls for evidence that on-premises nslookup against the conditional forwarder returns the expected Azure private address.

Virtual WAN Standard supports centralized hub routing and expanded branch/VNet connectivity services. However, the option would implement deploy Azure Virtual WAN Standard with suitably placed virtual hubs and branch connections; the scenario instead requires provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits. The differentiating evidence is that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

Route-table design can limit unwanted prefix propagation rather than assuming every connected site should transit. However, the option would implement use distinct Virtual WAN route tables and controlled association/propagation to enforce network isolation; the scenario instead requires provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits. The differentiating evidence is that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

Secured virtual hubs can centralize approved traffic inspection through firewall policies and routing. However, the option would implement deploy Azure Firewall into a secured virtual hub and configure supported routing intent and policies; the scenario instead requires provision an ExpressRoute gateway in the Virtual WAN virtual hub and connect eligible circuits. The differentiating evidence is that the virtual hub ExpressRoute connection is established and routes reach intended private VNet resources.

Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. However, the option would implement configure suitable load-balancing rules including HA ports where the chosen internal design supports them; the scenario instead requires create an internal Azure Load Balancer with a private frontend and eligible backend pool. The differentiating evidence is that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. However, the option would implement adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design; the scenario instead requires create an internal Azure Load Balancer with a private frontend and eligible backend pool. The differentiating evidence is that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

Cross-region Load Balancer extends supported layer-4 distribution across healthy regional frontends. However, the option would implement use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers; the scenario instead requires create an internal Azure Load Balancer with a private frontend and eligible backend pool. The differentiating evidence is that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.