For on-premises traffic (coming through a VPN or ExpressRoute gateway) to be forced through a hub NVA, a User-Defined Route (UDR) must be applied to the GatewaySubnet in the hub virtual network. This UDR must have a route (often 0.0.0.0/0 or specific address spaces) with a next hop type of ‘Virtual Appliance’ and the NVA’s private IP address. Without this UDR, traffic from on-premises to spokes will use the system route learned via BGP or the gateway, allowing it to go directly to the peered spoke VNet, bypassing inspection.

A common cause for health probe failures is a protocol or port mismatch. If the health probe is configured for HTTPS (port 443) but the backend web application is only listening on HTTP (port 80), the probe will fail, causing the backend to be marked unhealthy. This leads to 502 errors as the Application Gateway has no healthy targets to route requests to. The other options are less likely: using public IPs can work but is not a direct cause of probe failure; a default route to a firewall would break outbound internet but not necessarily inbound probes; and NSGs on the gateway subnet typically allow necessary Azure infrastructure traffic.

For the highest level of resilience that avoids a single point of failure at both the provider and the Azure peering location level, you should implement dual circuits from different service providers, each terminating in separate Azure peering locations (e.g., London and Amsterdam). This protects against failures in the local provider’s network, the physical Azure peering location, and the cross-connect within a single datacenter. Using the same provider or same location does not protect against failures at those specific points. Global Reach connects on-premises sites, not for Azure redundancy. Private and Microsoft peering are logical configurations on a single circuit, not a physical redundancy solution.

In Azure Virtual WAN, connectivity between different resources (like P2S users and VNet spokes) is controlled by routing. Each connection (P2S, S2S, VNet) is associated with a route table. For a P2S user to reach a spoke VNet, the route table associated with the P2S connection must have the routes for the spoke VNet’s address space. These routes are typically propagated automatically from the VNet connection. If propagation is disabled or misconfigured, the P2S user’s route table will not have the necessary routes, resulting in the described symptom. The other options are less specific: branch-to-branch enables S2S/P2S inter-connectivity but is likely already on; IP overlap would affect all users; and Basic SKU lacks certain features but wouldn’t cause an isolated user issue.

Private Endpoints provide a private IP address for the PaaS service within your virtual network, making it accessible via private connectivity (like ExpressRoute private peering or VPN) without any public exposure. However, the PaaS service’s default hostname (e.g., database.windows.net) resolves to a public IP. To ensure on-premises clients resolve the name to the private IP address, you must integrate the Private Endpoint with Azure Private DNS Zones. This provides seamless, private name resolution. Service Endpoints only secure traffic from within Azure, not from on-premises. Using Microsoft Peering with public endpoints still involves public IP space. Azure Firewall is not required for the core private connectivity need.

Azure Firewall Premium’s URL Filtering feature for HTTPS traffic requires TLS Inspection to decrypt the traffic and examine the URL in the HTTPS request. For TLS Inspection to work, the clients must trust the Certificate Authority (CA) certificate that the Azure Firewall Premium uses to perform the man-in-the-middle decryption. If this certificate is not deployed to the trusted root store of the client machines, the TLS handshake will fail, and the firewall will typically allow the traffic to pass without inspection (based on its policy setting), resulting in the filtering not being applied. The other options are incorrect: rule priority matters, but misconfiguration would block all traffic, not just filtering; category-based filtering is a core feature of Premium; and DoH is a concern, but the primary blocker for HTTPS URL inspection is TLS certificate trust.

For an Azure Load Balancer Standard to direct traffic (including traffic from a NAT rule) to a virtual machine, the network interface (or the VM’s IP configuration) of that target VM must be explicitly added to the Load Balancer’s backend pool. The NAT rule itself only defines the mapping from the frontend port to a backend port and IP address, but it relies on the backend pool membership to know where to send the traffic. It’s a common oversight to create the NAT rule and the VM but forget to associate the VM with the backend pool. Health probes are not required for NAT rules. Outbound rules are for SNAT, not inbound connectivity. Floating IP is used for specific high-availability scenarios, not basic NAT functionality.

Network Security Groups are stateful. This means that if an NSG allows an inbound connection (e.g., from the web tier to the DB tier on port 1433), it automatically allows the return traffic for that established session. Crucially, this return traffic is not a new *initiated* connection from the DB to the Web tier. Therefore, by placing an NSG on the DB subnet that only allows inbound traffic from the web tier and has no explicit outbound rules that permit new connections to the web tier, you achieve the goal. The DB tier can respond to established sessions but cannot start a new, unsolicited connection back to the web tier. Azure Firewall could also do this but is overkill when NSGs suffice. UDRs control routing, not connection initiation.

A virtual machine’s private IP address is a property of its network interface (NIC), not the VM itself. To preserve the IP address, you must work directly with the NIC resource. The process is: 1) Stop/deallocate the VM. 2) Detach the NIC from the VM. 3) Change the IP configuration of the now-standalone NIC—you can assign it to a new subnet (in the same or a different VNet, provided the address space is valid). 4) Reattach the NIC to the (same or a different) VM. The IP address is retained because the NIC object itself, with its configuration, is moved. The other options are incorrect: moving the VM resource does not allow IP retention; a Load Balancer cannot reassign primary IPs; and it is possible via the NIC method.

For on-premises traffic (coming through a VPN or ExpressRoute gateway) to be forced through a hub NVA, a User-Defined Route (UDR) must be applied to the GatewaySubnet in the hub virtual network. This UDR must have a route (often 0.0.0.0/0 or specific address spaces) with a next hop type of ‘Virtual Appliance’ and the NVA’s private IP address. Without this UDR, traffic from on-premises to spokes will use the system route learned via BGP or the gateway, allowing it to go directly to the peered spoke VNet, bypassing inspection.0