Microsoft AZ-700 Bundle

Although ExpressRoute FastPath improves data path behavior by bypassing the gateway for supported ExpressRoute data traffic, that is not sufficient to connect a VNet to an ExpressRoute circuit through the managed gateway in this case.

ExpressRoute private peering is useful when the goal is to provide private routing to VNet private address spaces over an ExpressRoute circuit. Here, the required behavior is to connect a VNet to an ExpressRoute circuit through the managed gateway.

This choice allows an approved cross-subscription connection to an ExpressRoute circuit. It leaves the specific need to connect a VNet to an ExpressRoute circuit through the managed gateway unaddressed.

Firewall logs and threat intelligence monitoring uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic. The current problem instead requires a control that routes Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge.

This alternative translates an approved public destination address and port to a protected internal service, which solves a different networking task. It does not directly route Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge.

This choice fits eligible smaller workloads when advanced throughput and security features are not required. It leaves the specific need to route Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge unaddressed.

That approach aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device; it does not replace S2S reachability verification beyond tunnel state for the constraint in this scenario.

Route-based site-to-site VPN gateway is useful when the goal is to support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device. Here, the required behavior is to validate routing, NSGs and return paths after IPsec reports connected.

VPN connection status and tunnel diagnostics inspects tunnel state, negotiated parameters and gateway logs before changing routes. The current problem instead requires a control that validates routing, NSGs and return paths after IPsec reports connected.

Although Private Endpoint hostname-specific TLS handling uses the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients, that is not sufficient to map the service's normal FQDN to its private endpoint IP address for authorized clients in this case.

Private Endpoint for PaaS private IP access is useful when the goal is to expose a supported Azure service through a private IP interface in the consumer VNet. Here, the required behavior is to map the service's normal FQDN to its private endpoint IP address for authorized clients.

That approach uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint; it does not replace Private Endpoint DNS A-record integration for the constraint in this scenario.

That approach organizes matching firewall rules with correct ordering and actions; it does not replace Azure Firewall DNAT rule for the constraint in this scenario.

Azure Firewall Policy across regions is useful when the goal is to centralize managed firewall settings and reusable rule collections. Here, the required behavior is to translate an approved public destination address and port to a protected internal service.

Firewall forced tunneling via approved next hop is useful when the goal is to route Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge. Here, the required behavior is to translate an approved public destination address and port to a protected internal service.

Although NIC-level public IP association attaches the public IP to the correct network interface IP configuration, that is not sufficient to onboard an organization's eligible public IPv4 address block into Azure in this case.

This choice reserves a managed contiguous block of standard public addresses for public IP resources. It leaves the specific need to onboard an organization's eligible public IPv4 address block into Azure unaddressed.

This choice expands address capacity while managing dependencies and routing effects. It leaves the specific need to onboard an organization's eligible public IPv4 address block into Azure unaddressed.

Although WAF prevention mode for active blocking blocks HTTP requests that match configured WAF enforcement rules, that is not sufficient to narrow a proven harmless match while retaining the remainder of managed protections in this case.

This choice uses a supported managed web attack signature rule set for common application threats. It leaves the specific need to narrow a proven harmless match while retaining the remainder of managed protections unaddressed.

That approach logs matching malicious patterns without blocking legitimate traffic during a controlled baseline; it does not replace WAF false-positive exclusion tuning for the constraint in this scenario.

Although Azure-provided DNS for VNet hostnames resolves supported internal hostnames using default Azure DNS within a VNet, that is not sufficient to send selected Azure DNS queries toward other DNS servers through managed forwarding in this case.

Azure DNS Private Resolver inbound endpoint accepts DNS queries arriving from on-premises or connected networks into Azure resolution. The current problem instead requires a control that sends selected Azure DNS queries toward other DNS servers through managed forwarding.

DNS private endpoint record validation is useful when the goal is to confirm private service FQDNs resolve to the intended private endpoint addresses. Here, the required behavior is to send selected Azure DNS queries toward other DNS servers through managed forwarding.

ExpressRoute gateway on VNet is useful when the goal is to connect a VNet to an ExpressRoute circuit through the managed gateway. Here, the required behavior is to use redundant circuits or locations as required to survive equipment and site failures.

ExpressRoute BFD for rapid failure detection is useful when the goal is to use supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone. Here, the required behavior is to use redundant circuits or locations as required to survive equipment and site failures.

ExpressRoute Global Reach is useful when the goal is to connect on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity. Here, the required behavior is to use redundant circuits or locations as required to survive equipment and site failures.

NAT Gateway subnet association is useful when the goal is to apply a NAT Gateway's outbound SNAT behavior to a selected subnet. Here, the required behavior is to assign supported public IP or public IP prefix resources to the gateway.

This choice lets an eligible peered spoke use a hub's VPN or ExpressRoute gateway. It leaves the specific need to assign supported public IP or public IP prefix resources to the gateway unaddressed.

This choice provides scalable managed outbound connectivity for private subnet workloads. It leaves the specific need to assign supported public IP or public IP prefix resources to the gateway unaddressed.

Application Gateway TLS termination is useful when the goal is to terminate client HTTPS on the gateway with the appropriate certificate and listener. Here, the required behavior is to match incoming protocol, port and optional host name before routing requests.

This alternative provides managed regional Layer 7 routing, TLS termination and web traffic distribution, which solves a different networking task. It does not directly match incoming protocol, port and optional host name before routing requests.

This choice configures supported backend protocol, port, host-name and session behavior. It leaves the specific need to match incoming protocol, port and optional host name before routing requests unaddressed.