Microsoft AZ-700 Bundle

This choice supports site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology. It leaves the specific need to terminate VPN connections from branches within the managed virtual hub unaddressed.

This choice sizes a managed virtual-hub gateway for required bandwidth and connections. It leaves the specific need to terminate VPN connections from branches within the managed virtual hub unaddressed.

Virtual WAN hub VNet connection is useful when the goal is to attache a workload VNet to a managed virtual hub for connectivity and route propagation. Here, the required behavior is to terminate VPN connections from branches within the managed virtual hub.

That approach deploys a Microsoft-managed regional hub for connectivity, routing and gateway services; it does not replace Virtual WAN secure hub with Azure Firewall for the constraint in this scenario.

Virtual WAN gateway scale-unit planning sizes a managed virtual-hub gateway for required bandwidth and connections. The current problem instead requires a control that integrates managed central security inspection into a Virtual WAN virtual hub.

Virtual WAN hub VNet connection attaches a workload VNet to a managed virtual hub for connectivity and route propagation. The current problem instead requires a control that integrates managed central security inspection into a Virtual WAN virtual hub.

PaaS resource firewall VNet rule permits the specified subnet at the target managed service after a service endpoint is enabled. The current problem instead requires a control that restricts supported endpoint traffic from a subnet to specifically allowed Azure Storage resources.

This alternative extends selected Azure service routing and service identity from an approved VNet subnet, which solves a different networking task. It does not directly restrict supported endpoint traffic from a subnet to specifically allowed Azure Storage resources.

Service endpoint policy subnet binding is useful when the goal is to associate an approved service endpoint policy with the intended endpoint-enabled workload subnet. Here, the required behavior is to restrict supported endpoint traffic from a subnet to specifically allowed Azure Storage resources.

WAF policy association to listener or domain binds the WAF policy to the supported application gateway listener or edge domain. The current problem instead requires a control that inspects HTTP/S requests at a regional application gateway using supported WAF policies.

WAF on Azure Front Door for global edge protection is useful when the goal is to inspect web traffic at Microsoft's global edge before it reaches regional origins. Here, the required behavior is to inspect HTTP/S requests at a regional application gateway using supported WAF policies.

That approach blocks HTTP requests that match configured WAF enforcement rules; it does not replace WAF on Application Gateway for regional web protection for the constraint in this scenario.

Although Front Door origin health probe checks origin availability from the edge to exclude unhealthy backends, that is not sufficient to connect the matching frontend domain/path to the intended origin group in this case.

Front Door Private Link to supported origin is useful when the goal is to connect an eligible Front Door Premium origin privately without exposing it broadly. Here, the required behavior is to connect the matching frontend domain/path to the intended origin group.

This alternative selects healthy primary and secondary origins using configured priority and health, which solves a different networking task. It does not directly connect the matching frontend domain/path to the intended origin group.

Private DNS zone VNet link is useful when the goal is to permit a selected VNet's resolver to query records in a private DNS zone. Here, the required behavior is to resolve supported internal hostnames using default Azure DNS within a VNet.

This choice accepts DNS queries arriving from on-premises or connected networks into Azure resolution. It leaves the specific need to resolve supported internal hostnames using default Azure DNS within a VNet unaddressed.

Although Azure DNS Private Resolver outbound endpoint sends selected Azure DNS queries toward other DNS servers through managed forwarding, that is not sufficient to resolve supported internal hostnames using default Azure DNS within a VNet in this case.

P2S VPN client profile generation is useful when the goal is to deliver the correct gateway endpoints, routes and authentication settings to client devices. Here, the required behavior is to authenticate supported VPN clients using the organization's Entra identity platform.

That approach validates certificate-authenticated VPN clients against an uploaded trusted root; it does not replace Microsoft Entra ID P2S authentication for the constraint in this scenario.

That approach uses an existing supported RADIUS server for VPN user authentication; it does not replace Microsoft Entra ID P2S authentication for the constraint in this scenario.

This alternative restricts traffic entering a NIC or subnet by source, destination and service port, which solves a different networking task. It does not directly read merged effective rules after both subnet and NIC associations.

This alternative references application security groups as source or destination in supported NSG rules, which solves a different networking task. It does not directly read merged effective rules after both subnet and NIC associations.

NSG subnet association applies a network security group to all eligible network interfaces in a selected subnet. The current problem instead requires a control that reads merged effective rules after both subnet and NIC associations.

This alternative requires the service owner to authorize pending private endpoint connections when necessary, which solves a different networking task. It does not directly disable or limits public service exposure separately from creating the private endpoint.

Private Endpoint subresource selection targets the correct service resource and subresource in a private endpoint connection. The current problem instead requires a control that disables or limits public service exposure separately from creating the private endpoint.

Private Endpoint from on-premises via hybrid route is useful when the goal is to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. Here, the required behavior is to disable or limits public service exposure separately from creating the private endpoint.

Although Private Endpoint migration cutover updates endpoint connections, DNS and service firewall settings together during a resource move, that is not sufficient to require the service owner to authorize pending private endpoint connections when necessary in this case.

Private Endpoint resource-specific authorization is useful when the goal is to scope a private-link connection to the intended service instance and applies provider-side approval and service access restrictions. Here, the required behavior is to require the service owner to authorize pending private endpoint connections when necessary.

Private Endpoint subresource selection targets the correct service resource and subresource in a private endpoint connection. The current problem instead requires a control that requires the service owner to authorize pending private endpoint connections when necessary.

Although ExpressRoute FastPath improves data path behavior by bypassing the gateway for supported ExpressRoute data traffic, that is not sufficient to connect a VNet to an ExpressRoute circuit through the managed gateway in this case.

ExpressRoute private peering is useful when the goal is to provide private routing to VNet private address spaces over an ExpressRoute circuit. Here, the required behavior is to connect a VNet to an ExpressRoute circuit through the managed gateway.

This choice allows an approved cross-subscription connection to an ExpressRoute circuit. It leaves the specific need to connect a VNet to an ExpressRoute circuit through the managed gateway unaddressed.