Microsoft AZ-700 Bundle

This alternative returns an HTTP redirect to the client for an approved URL transformation, which solves a different networking task. It does not directly change the upstream URL path while the client's visible URL remains stable.

This choice applies supported application-layer rules at the globally distributed edge. It leaves the specific need to change the upstream URL path while the client's visible URL remains stable unaddressed.

This alternative connects the matching frontend domain/path to the intended origin group, which solves a different networking task. It does not directly change the upstream URL path while the client's visible URL remains stable.

Although Service endpoint policy subnet binding associates an approved service endpoint policy with the intended endpoint-enabled workload subnet, that is not sufficient to verify whether the selected PaaS resource type supports service endpoints before planning access in this case.

VNet service endpoint enablement extends selected Azure service routing and service identity from an approved VNet subnet. The current problem instead requires a control that verifies whether the selected PaaS resource type supports service endpoints before planning access.

This alternative permits the specified subnet at the target managed service after a service endpoint is enabled, which solves a different networking task. It does not directly verify whether the selected PaaS resource type supports service endpoints before planning access.

Azure Firewall application rule is useful when the goal is to apply FQDN- or application-aware outbound access controls for supported protocols. Here, the required behavior is to permit or denies supported IP-based TCP or UDP flows by addresses and ports.

Azure Firewall DNS proxy is useful when the goal is to provide centrally proxied DNS resolution for supported FQDN-based network policy. Here, the required behavior is to permit or denies supported IP-based TCP or UDP flows by addresses and ports.

Azure Firewall policy rule collection priority is useful when the goal is to organize matching firewall rules with correct ordering and actions. Here, the required behavior is to permit or denies supported IP-based TCP or UDP flows by addresses and ports.

Private DNS zone VNet link is useful when the goal is to permit a selected VNet's resolver to query records in a private DNS zone. Here, the required behavior is to direct VNet-resident clients to selected DNS servers for specialized resolution.

Although Azure private DNS zone stores DNS records visible through linked private-network resolution rather than public DNS, that is not sufficient to direct VNet-resident clients to selected DNS servers for specialized resolution in this case.

That approach sends selected Azure DNS queries toward other DNS servers through managed forwarding; it does not replace Custom DNS server settings on VNet for the constraint in this scenario.

Although Front Door route and origin mapping connects the matching frontend domain/path to the intended origin group, that is not sufficient to balance requests among equally prioritized healthy origins using configured weights in this case.

Front Door Private Link to supported origin is useful when the goal is to connect an eligible Front Door Premium origin privately without exposing it broadly. Here, the required behavior is to balance requests among equally prioritized healthy origins using configured weights.

Front Door origin group priority failover is useful when the goal is to select healthy primary and secondary origins using configured priority and health. Here, the required behavior is to balance requests among equally prioritized healthy origins using configured weights.

This choice provides scalable managed outbound connectivity for private subnet workloads. It leaves the specific need to centrally coordinate VNet connectivity topology across many subscriptions unaddressed.

This alternative centrally enforces supported security policies across network groups before workload NSGs, which solves a different networking task. It does not directly centrally coordinate VNet connectivity topology across many subscriptions.

Although VNet peering for private backbone connectivity connects two Azure virtual networks over the Microsoft backbone without a VPN appliance, that is not sufficient to centrally coordinate VNet connectivity topology across many subscriptions in this case.

This choice re-encrypts or retains HTTPS between the gateway and validated backend endpoints. It leaves the specific need to configure supported backend protocol, port, host-name and session behavior unaddressed.

Application Gateway autoscale adjusts supported v2 gateway capacity automatically to demand within configured boundaries. The current problem instead requires a control that configures supported backend protocol, port, host-name and session behavior.

Although Application Gateway HTTP listener matches incoming protocol, port and optional host name before routing requests, that is not sufficient to configure supported backend protocol, port, host-name and session behavior in this case.

This choice checks an application-specific path and expected response before including backends. It leaves the specific need to use host-based listeners to select application backends for different domain names unaddressed.

Application Gateway path-based routing rule is useful when the goal is to select different backends based on URL path patterns. Here, the required behavior is to use host-based listeners to select application backends for different domain names.

Application Gateway HTTP listener matches incoming protocol, port and optional host name before routing requests. The current problem instead requires a control that uses host-based listeners to select application backends for different domain names.

Although NSG subnet association applies a network security group to all eligible network interfaces in a selected subnet, that is not sufficient to group VM interfaces by application role for NSG rule targeting in this case.

That approach references application security groups as source or destination in supported NSG rules; it does not replace Application Security Group membership for the constraint in this scenario.

Although Azure Bastion for browser-based VM administration provides managed remote VM access without exposing RDP or SSH public IPs on each VM, that is not sufficient to group VM interfaces by application role for NSG rule targeting in this case.

Although Network Watcher IP flow verify identifies an NSG rule that allows or denies a specified VM traffic flow, that is not sufficient to identify exploitable attack paths that connect exposure and privilege to important assets in this case.

Network Watcher next hop determines a VM's effective route and next-hop category to a destination. The current problem instead requires a control that identifies exploitable attack paths that connect exposure and privilege to important assets.

This alternative prioritizes cloud security posture findings including exposed network resources, which solves a different networking task. It does not directly identify exploitable attack paths that connect exposure and privilege to important assets.

This alternative provides managed stateful network and application filtering without Premium-only inspection, which solves a different networking task. It does not directly use the Premium tier's supported TLS inspection and advanced threat features.

That approach uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic; it does not replace Azure Firewall Premium for TLS inspection for the constraint in this scenario.

This alternative fits eligible smaller workloads when advanced throughput and security features are not required, which solves a different networking task. It does not directly use the Premium tier's supported TLS inspection and advanced threat features.