Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. However, the option would implement configure suitable load-balancing rules including HA ports where the chosen internal design supports them; the scenario instead requires create an internal Azure Load Balancer with a private frontend and eligible backend pool. The differentiating evidence is that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. However, the option would implement adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design; the scenario instead requires create an internal Azure Load Balancer with a private frontend and eligible backend pool. The differentiating evidence is that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

Cross-region Load Balancer extends supported layer-4 distribution across healthy regional frontends. However, the option would implement use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers; the scenario instead requires create an internal Azure Load Balancer with a private frontend and eligible backend pool. The differentiating evidence is that an internal client reaches the frontend private IP and probes show only healthy backend nodes receive requests.

Private DNS zone visibility follows VNet links and resolution architecture, not merely peering topology. However, the option would implement plan consistent private DNS zone links or resolver forwarding across the client VNets; the scenario instead requires remove or reject only the obsolete private endpoint connection and clean up its DNS records. The differentiating evidence is that the retired consumer route no longer works and active approved consumers remain connected.

Private Link service exposes a provider-hosted private service to consumer private endpoints. However, the option would implement publish a supported Private Link service behind the internal Standard Load Balancer and approve consumer endpoints; the scenario instead requires remove or reject only the obsolete private endpoint connection and clean up its DNS records. The differentiating evidence is that the retired consumer route no longer works and active approved consumers remain connected.

Disabling the public endpoint before validating private name resolution and routes can cause an avoidable outage. However, the option would implement sequence private endpoint approval, private DNS, connectivity testing and then public network restriction; the scenario instead requires remove or reject only the obsolete private endpoint connection and clean up its DNS records. The differentiating evidence is that the retired consumer route no longer works and active approved consumers remain connected.

That observation would primarily validate another control: collect DNS results, effective routes and connection diagnostics as separate evidence before remedial changes. An allow rule alone cannot establish name resolution, correct next hop and application endpoint identity. The situation calls for evidence that a safe degraded-link test or monitored incident triggers the expected alert with affected resource context.

That observation would primarily validate another control: use Network Watcher IP flow verify or effective security rules for the exact source/destination tuple. Effective NSG evaluation identifies the allow or deny rule governing a specific flow. The situation calls for evidence that a safe degraded-link test or monitored incident triggers the expected alert with affected resource context.

That observation would primarily validate another control: inventory DDoS protection plan associations and protected public IP resources in governance checks. A DDoS plan or protection policy only helps resources properly associated within its supported scope. The situation calls for evidence that a safe degraded-link test or monitored incident triggers the expected alert with affected resource context.

Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. However, the option would implement enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings; the scenario instead requires configure supported internal and public frontend IP configurations and bind listeners to the intended frontend. The differentiating evidence is that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. However, the option would implement configure appropriate multi-site listeners and host-based routing rules on Application Gateway; the scenario instead requires configure supported internal and public frontend IP configurations and bind listeners to the intended frontend. The differentiating evidence is that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. However, the option would implement attach a supported Application Gateway WAF policy in the intended enforcement mode; the scenario instead requires configure supported internal and public frontend IP configurations and bind listeners to the intended frontend. The differentiating evidence is that the private listener cannot be reached from the Internet and public HTTPS reaches only the approved site.

Inbound NAT rules target specific backend machines instead of spreading a flow across a load-balanced pool. However, the option would implement create inbound NAT rules that map unique frontend ports to designated backend endpoints; the scenario instead requires deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes. The differentiating evidence is that external clients connect through the public frontend and failed backends stop receiving traffic.

Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. However, the option would implement configure Azure Traffic Manager with the correct routing method and endpoint health checks; the scenario instead requires deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes. The differentiating evidence is that external clients connect through the public frontend and failed backends stop receiving traffic.

DNS-based traffic management cannot immediately override resolver/client caches holding prior answers. However, the option would implement adjust Traffic Manager DNS TTL and plan client-cache limitations in the failover design; the scenario instead requires deploy a Standard public Azure Load Balancer with a supported public IP frontend and health probes. The differentiating evidence is that external clients connect through the public frontend and failed backends stop receiving traffic.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that a fresh request after purge returns updated origin content rather than the old cached version.

That observation would primarily validate another control: configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates. The client-to-edge and edge-to-origin TLS connections are distinct and must both be configured. The situation calls for evidence that a fresh request after purge returns updated origin content rather than the old cached version.

That observation would primarily validate another control: associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns. Front Door WAF evaluates incoming HTTP requests at the edge before routing to origins. The situation calls for evidence that a fresh request after purge returns updated origin content rather than the old cached version.

Ruleset links determine which VNets apply the conditional forwarding rules; peering alone is insufficient. However, the option would implement link the intended spoke VNet to the appropriate DNS forwarding ruleset; the scenario instead requires apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. The differentiating evidence is that an authorized test query receives the intended block result and a policy event is recorded.

Hosting a public DNS zone requires parent-domain delegation; private zone links do not make records public. However, the option would implement create a public Azure DNS zone and delegate the domain at the registrar to its Azure name servers; the scenario instead requires apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. The differentiating evidence is that an authorized test query receives the intended block result and a policy event is recorded.

Public Azure DNS zones and private DNS zones have different visibility and delegation semantics. However, the option would implement plan internal private DNS zones and public DNS hosting as distinct authoritative resolution scopes; the scenario instead requires apply supported Azure DNS security controls or approved filtering resolvers at the intended VNet scope. The differentiating evidence is that an authorized test query receives the intended block result and a policy event is recorded.

That observation would primarily validate another control: configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination. Network rules are appropriate for transport and IP-address traffic that is not evaluated as HTTP hostnames. The situation calls for evidence that an approved safe detection sample produces an IDPS event and permitted TLS traffic is inspected without certificate errors.

That observation would primarily validate another control: create an Azure Firewall application rule scoped to the required FQDN and protocol. Application rules provide suitable FQDN-aware policy for supported HTTP/S destinations. The situation calls for evidence that an approved safe detection sample produces an IDPS event and permitted TLS traffic is inspected without certificate errors.

That observation would primarily validate another control: deploy Azure Firewall into a supported hub and route workload egress through its private IP. Azure Firewall provides managed stateful network and application filtering when traffic is actually routed through it. The situation calls for evidence that an approved safe detection sample produces an IDPS event and permitted TLS traffic is inspected without certificate errors.

That observation would primarily validate another control: create dedicated appropriately sized subnets delegated to Microsoft.Network/dnsResolvers for resolver endpoints. Inbound and outbound resolver endpoints use dedicated subnets that cannot host unrelated workloads. The situation calls for evidence that an authorized test query receives the intended block result and a policy event is recorded.

That observation would primarily validate another control: create or use the service-specific Private DNS zone and link the client VNet so names resolve to endpoint IPs. Private Link connectivity commonly depends on the appropriate privatelink DNS zone and VNet link. The situation calls for evidence that an authorized test query receives the intended block result and a policy event is recorded.

That observation would primarily validate another control: link the intended spoke VNet to the appropriate DNS forwarding ruleset. Ruleset links determine which VNets apply the conditional forwarding rules; peering alone is insufficient. The situation calls for evidence that an authorized test query receives the intended block result and a policy event is recorded.

That observation would primarily validate another control: choose the service-supported delegated subnet and remove incompatible delegation or workload placements. Subnet delegation is scoped to supported service providers and imposes placement constraints. The situation calls for evidence that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

That observation would primarily validate another control: provision an appropriately sized dedicated subnet named AzureFirewallSubnet for Azure Firewall. Azure Firewall uses a specific reserved subnet name and supported minimum capacity for deployment and scaling. The situation calls for evidence that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

That observation would primarily validate another control: place Application Gateway in its own eligible subnet and keep backend workloads in separate subnets. Application Gateway requires supported subnet placement; separating front-end infrastructure avoids unsupported coexistence. The situation calls for evidence that a supported dual-stack client reaches the intended IPv6 front end and IPv4 traffic continues to work.

Routing and filtering are independent controls; both must support a successful end-to-end connection. However, the option would implement compare Network Watcher effective routes and effective security rules for the affected NIC; the scenario instead requires enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs. The differentiating evidence is that protection status is correct and authorized monitoring reports mitigation metrics during a test or observed attack.

Healthy connection resources do not prove application reachability across security and routing boundaries. However, the option would implement use Network Watcher connectivity testing and route diagnostics from a representative Azure source; the scenario instead requires enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs. The differentiating evidence is that protection status is correct and authorized monitoring reports mitigation metrics during a test or observed attack.

Attack path analysis evaluates connected weaknesses rather than treating each network setting in isolation. However, the option would implement use Defender for Cloud attack path analysis to identify exploitable exposure chains; the scenario instead requires enable supported Azure DDoS Network Protection at the correct VNet scope and monitor its metrics and logs. The differentiating evidence is that protection status is correct and authorized monitoring reports mitigation metrics during a test or observed attack.