That observation would primarily validate another control: approve the intended private endpoint connection on the target resource before testing access. Some Private Link connections require resource-owner approval before private traffic is accepted. The situation calls for evidence that each consumer connects through its assigned local private address without overlapping network route conflicts.

That observation would primarily validate another control: publish only the eligible Private Link service target with appropriate access policy rather than VNet peering. Private Link service provides service-level exposure instead of broad routed connectivity to a provider VNet. The situation calls for evidence that each consumer connects through its assigned local private address without overlapping network route conflicts.

That observation would primarily validate another control: require manual approval or an appropriate RBAC-based connection workflow for Private Link consumers. Connection approval separates consumer endpoint provisioning from provider authorization. The situation calls for evidence that each consumer connects through its assigned local private address without overlapping network route conflicts.

Public IP Prefix reserves a contiguous block for predictable public IP allocation to Azure resources. However, the option would implement allocate a Public IP Prefix and create supported public IP resources from that prefix; the scenario instead requires use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources. The differentiating evidence is that the worker serves internal requests without a public NIC IP and only approved ingress endpoints are Internet reachable.

Connected peers and gateways must recognize updated prefixes and traffic cannot rely on stale addressing during migration. However, the option would implement plan address-space updates with peering synchronization and dependency validation before routing cutover; the scenario instead requires use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources. The differentiating evidence is that the worker serves internal requests without a public NIC IP and only approved ingress endpoints are Internet reachable.

Private endpoints consume IP addresses in an eligible subnet and their network policy behavior must be configured deliberately. However, the option would implement reserve sufficient unused private addresses for private endpoints and validate subnet policy compatibility; the scenario instead requires use private addresses for internal workloads and only attach public IPs to explicitly required Internet-facing resources. The differentiating evidence is that the worker serves internal requests without a public NIC IP and only approved ingress endpoints are Internet reachable.

Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. However, the option would implement use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing; the scenario instead requires configure Azure Traffic Manager with the correct routing method and endpoint health checks. The differentiating evidence is that dNS answers choose an eligible healthy endpoint and switch after a controlled failure within expected TTL behavior.

Cross-region Load Balancer extends supported layer-4 distribution across healthy regional frontends. However, the option would implement use supported cross-region Azure Load Balancer architecture with appropriate regional load balancers; the scenario instead requires configure Azure Traffic Manager with the correct routing method and endpoint health checks. The differentiating evidence is that dNS answers choose an eligible healthy endpoint and switch after a controlled failure within expected TTL behavior.

Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. However, the option would implement configure suitable load-balancing rules including HA ports where the chosen internal design supports them; the scenario instead requires configure Azure Traffic Manager with the correct routing method and endpoint health checks. The differentiating evidence is that dNS answers choose an eligible healthy endpoint and switch after a controlled failure within expected TTL behavior.

That observation would primarily validate another control: update local network gateway address spaces or validated BGP advertisements for the missing prefix. A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. The situation calls for evidence that negotiation completes with matching selectors and the configured on-premises network prefixes are reachable.

That observation would primarily validate another control: configure a supported active-active VPN gateway deployment and two corresponding tunnel endpoints. Active-active VPN gateway instances can provide redundant tunnel paths when peer devices support the design. The situation calls for evidence that negotiation completes with matching selectors and the configured on-premises network prefixes are reachable.

That observation would primarily validate another control: resolve overlapping address spaces through renumbering or a supported translation architecture before relying on S2S. Identical local and remote prefixes make destination routing ambiguous across a site-to-site tunnel. The situation calls for evidence that negotiation completes with matching selectors and the configured on-premises network prefixes are reachable.

NSG rules are evaluated by ascending priority until a matching rule decides allow or deny. However, the option would implement correct NSG rule priorities and remove unintended overrides while preserving least-privilege filtering; the scenario instead requires use Azure Virtual Network Manager security admin configurations within supported scope. The differentiating evidence is that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

ASGs identify groups of NICs for rule targets without hard-coding changing workload IPs. However, the option would implement create an application security group and reference it in supported NSG rules for member network interfaces; the scenario instead requires use Azure Virtual Network Manager security admin configurations within supported scope. The differentiating evidence is that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

Azure service tags abstract changing Azure service address ranges in network security rules. However, the option would implement use the appropriate Azure service tag for supported NSG destination restrictions; the scenario instead requires use Azure Virtual Network Manager security admin configurations within supported scope. The differentiating evidence is that effective policy reflects the central security rule and an unauthorized local exemption does not bypass it.

That observation would primarily validate another control: use Front Door Premium Private Link origin connectivity and configure compatible origin private access. Azure Front Door Premium supports private link to selected origins to avoid general public origin exposure. The situation calls for evidence that a controlled origin outage moves new requests to the healthy alternate without client DNS reconfiguration.

That observation would primarily validate another control: create Front Door rules for supported redirect or URL rewrite behavior on the matching route. Front Door rules can modify edge request handling before forwarding to origin services. The situation calls for evidence that a controlled origin outage moves new requests to the healthy alternate without client DNS reconfiguration.

That observation would primarily validate another control: approve the required private endpoint connection and verify the origin's private link health. Private Link origin connectivity requires accepted connection state and valid private endpoint/DNS behavior. The situation calls for evidence that a controlled origin outage moves new requests to the healthy alternate without client DNS reconfiguration.

That observation would primarily validate another control: reduce record TTL before a planned migration and validate propagation and client cache expiry. DNS caching can delay a record change independently of network route availability. The situation calls for evidence that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

That observation would primarily validate another control: separate the private DNS resolution scopes using environment-specific zones and deliberate VNet links. Name resolution visibility is determined by private-zone linking and namespace selection. The situation calls for evidence that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

That observation would primarily validate another control: enable autoregistration for the appropriate VNet link to an Azure Private DNS zone. Private DNS zone autoregistration creates VM hostname records for eligible linked VNet resources. The situation calls for evidence that affected VMs show the new resolver IP and successfully resolve representative internal and external records.

That observation would primarily validate another control: select a supported VPN gateway SKU meeting tunnel counts, throughput, BGP and resiliency requirements. Gateway SKU capacity and feature support determine whether a hybrid design can meet operational needs. The situation calls for evidence that the packet path is identified and a corrected route sends traffic over the intended active tunnel.

That observation would primarily validate another control: update local network gateway address spaces or validated BGP advertisements for the missing prefix. A healthy VPN tunnel cannot carry traffic to destinations not represented by routing information. The situation calls for evidence that the packet path is identified and a corrected route sends traffic over the intended active tunnel.

That observation would primarily validate another control: resize the dedicated GatewaySubnet appropriately and select a supported VPN gateway SKU. Gateway SKUs have deployment and capacity requirements that must be met by the dedicated reserved subnet. The situation calls for evidence that the packet path is identified and a corrected route sends traffic over the intended active tunnel.

That observation would primarily validate another control: enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. The situation calls for evidence that the custom probe reports healthy and routed requests are delivered to the backend.

That observation would primarily validate another control: configure an Application Gateway rewrite rule set matching the required request or response conditions. Rewrite rules modify supported HTTP header and URL aspects without requiring changes in every backend service. The situation calls for evidence that the custom probe reports healthy and routed requests are delivered to the backend.

That observation would primarily validate another control: configure an HTTP listener that redirects to the corresponding HTTPS listener on Application Gateway. An HTTP-to-HTTPS redirect moves the client to a TLS endpoint rather than serving sensitive content over HTTP. The situation calls for evidence that the custom probe reports healthy and routed requests are delivered to the backend.

That observation would primarily validate another control: configure appropriate Load Balancer probe and rollout health gating for backend readiness. Probe-driven backend health prevents new flows from being distributed to failing endpoints. The situation calls for evidence that outbound connection tests succeed at peak concurrency and the public source addresses match the plan.

That observation would primarily validate another control: configure Traffic Manager Weighted routing across the regional endpoints. Weighted Traffic Manager policies influence DNS answer distribution across eligible healthy endpoints. The situation calls for evidence that outbound connection tests succeed at peak concurrency and the public source addresses match the plan.

That observation would primarily validate another control: configure an eligible health probe and backend listener that match the service port and NSG rules. Load Balancer health probes decide which backends are eligible for new flows. The situation calls for evidence that outbound connection tests succeed at peak concurrency and the public source addresses match the plan.

Stateful firewalls need consistent bidirectional session visibility or supported asymmetric-flow handling. However, the option would implement validate symmetric request and return routes through the stateful inspection appliance; the scenario instead requires apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. The differentiating evidence is that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

Route Server exchanges BGP information with compatible appliances and Azure networking instead of relying on static edits. However, the option would implement use Azure Route Server with a supported BGP peer to exchange routes dynamically; the scenario instead requires apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. The differentiating evidence is that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.

A VNet cannot consume incompatible multiple remote gateways or combine remote gateway use arbitrarily with a local gateway. However, the option would implement respect gateway transit restrictions and redesign the hub/spoke gateway placement if a conflict exists; the scenario instead requires apply a 0.0.0.0/0 user-defined route to the approved firewall or appliance next hop. The differentiating evidence is that the source NIC effective route chooses the appliance for default traffic and firewall logs show the egress flow.