Microsoft AZ-700 Bundle

That approach connects two Azure virtual networks over the Microsoft backbone without a VPN appliance; it does not replace Private DNS zone access for peered VNets for the constraint in this scenario.

VNet address-space peering sync is useful when the goal is to update peering awareness after VNet address-space changes. Here, the required behavior is to link the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution.

Although Allow forwarded traffic on VNet peering permits forwarded packets between peered VNets through a hub appliance where appropriate, that is not sufficient to link the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution in this case.

ASG-based NSG access rule is useful when the goal is to reference application security groups as source or destination in supported NSG rules. Here, the required behavior is to restrict traffic entering a NIC or subnet by source, destination and service port.

Although NSG outbound rule destination and port restricts workloads initiating network connections toward disallowed destinations, that is not sufficient to restrict traffic entering a NIC or subnet by source, destination and service port in this case.

This alternative tests a specified source/destination/port and reports the allowing or blocking NSG rule, which solves a different networking task. It does not directly restrict traffic entering a NIC or subnet by source, destination and service port.

That approach places Azure Firewall in its designated subnet with the required supported size; it does not replace Azure Firewall Basic for simple network filtering for the constraint in this scenario.

This choice uses the Premium tier's supported TLS inspection and advanced threat features. It leaves the specific need to fit eligible smaller workloads when advanced throughput and security features are not required unaddressed.

This choice provides managed stateful network and application filtering without Premium-only inspection. It leaves the specific need to fit eligible smaller workloads when advanced throughput and security features are not required unaddressed.

This alternative directs selected subnet traffic to a nominated next-hop NVA address, which solves a different networking task. It does not directly check both forward and return routing when traffic crosses a central firewall or appliance.

This choice connects two Azure virtual networks over the Microsoft backbone without a VPN appliance. It leaves the specific need to check both forward and return routing when traffic crosses a central firewall or appliance unaddressed.

This choice permits forwarded packets between peered VNets through a hub appliance where appropriate. It leaves the specific need to check both forward and return routing when traffic crosses a central firewall or appliance unaddressed.

Although Public IP Prefix for contiguous outbound allocation reserves a managed contiguous block of standard public addresses for public IP resources, that is not sufficient to assign a routable public endpoint to a specified Azure resource when direct exposure is justified in this case.

This alternative selects the supported public IP SKU and zone behavior for the intended resource and region, which solves a different networking task. It does not directly assign a routable public endpoint to a specified Azure resource when direct exposure is justified.

Although NIC-level public IP association attaches the public IP to the correct network interface IP configuration, that is not sufficient to assign a routable public endpoint to a specified Azure resource when direct exposure is justified in this case.

Private Endpoint for PaaS private IP access exposes a supported Azure service through a private IP interface in the consumer VNet. The current problem instead requires a control that deploys a supported private endpoint NIC in the correct consumer VNet subnet.

Private Endpoint subresource selection is useful when the goal is to target the correct service resource and subresource in a private endpoint connection. Here, the required behavior is to deploy a supported private endpoint NIC in the correct consumer VNet subnet.

Although Private Endpoint NSG and route policy support applies enabled private endpoint network policies when traffic inspection or subnet filtering is needed, that is not sufficient to deploy a supported private endpoint NIC in the correct consumer VNet subnet in this case.

Front Door caching configuration is useful when the goal is to cache eligible static web responses at the global edge under explicit policy. Here, the required behavior is to apply supported application-layer rules at the globally distributed edge.

Front Door Private Link to supported origin is useful when the goal is to connect an eligible Front Door Premium origin privately without exposing it broadly. Here, the required behavior is to apply supported application-layer rules at the globally distributed edge.

Although Azure Front Door global application delivery provides globally distributed edge entry points with accelerated HTTP/S routing to origins, that is not sufficient to apply supported application-layer rules at the globally distributed edge in this case.

This choice deploys a Microsoft-managed regional hub for connectivity, routing and gateway services. It leaves the specific need to control which route table a hub connection uses for its forwarding decisions unaddressed.

This choice attaches a workload VNet to a managed virtual hub for connectivity and route propagation. It leaves the specific need to control which route table a hub connection uses for its forwarding decisions unaddressed.

Virtual WAN route propagation and labels is useful when the goal is to define which routes are advertised into selected hub route tables and connection groups. Here, the required behavior is to control which route table a hub connection uses for its forwarding decisions.

Private DNS zone group on private endpoint is useful when the goal is to integrate an endpoint with the appropriate private DNS zone records where supported. Here, the required behavior is to update endpoint connections, DNS and service firewall settings together during a resource move.

Private Endpoint subresource selection targets the correct service resource and subresource in a private endpoint connection. The current problem instead requires a control that updates endpoint connections, DNS and service firewall settings together during a resource move.

This choice requires the service owner to authorize pending private endpoint connections when necessary. It leaves the specific need to update endpoint connections, DNS and service firewall settings together during a resource move unaddressed.

That approach accounts for Azure-reserved addresses and workload growth in each subnet; it does not replace Service-specific subnet isolation for the constraint in this scenario.

This alternative delegates a subnet to a supported service so the platform can manage its integration requirements, which solves a different networking task. It does not directly keep dedicated platform subnets separate from shared workload subnets.

That approach reserves the specifically named subnet required for Azure Bastion; it does not replace Service-specific subnet isolation for the constraint in this scenario.