Microsoft AZ-700 Bundle

Application Gateway TLS termination is useful when the goal is to terminate client HTTPS on the gateway with the appropriate certificate and listener. Here, the required behavior is to match incoming protocol, port and optional host name before routing requests.

This alternative provides managed regional Layer 7 routing, TLS termination and web traffic distribution, which solves a different networking task. It does not directly match incoming protocol, port and optional host name before routing requests.

This choice configures supported backend protocol, port, host-name and session behavior. It leaves the specific need to match incoming protocol, port and optional host name before routing requests unaddressed.

This alternative applies supported application-layer rules at the globally distributed edge, which solves a different networking task. It does not directly protect client-to-edge and edge-to-origin traffic with compatible HTTPS settings.

This alternative connects an eligible Front Door Premium origin privately without exposing it broadly, which solves a different networking task. It does not directly protect client-to-edge and edge-to-origin traffic with compatible HTTPS settings.

This alternative checks origin availability from the edge to exclude unhealthy backends, which solves a different networking task. It does not directly protect client-to-edge and edge-to-origin traffic with compatible HTTPS settings.

This choice ensures private addresses belong to the selected subnet and interface configuration. It leaves the specific need to assign an intended stable private address to a VM network interface within its subnet unaddressed.

Standard Public IP for internet-facing VM assigns a routable public endpoint to a specified Azure resource when direct exposure is justified. The current problem instead requires a control that assigns an intended stable private address to a VM network interface within its subnet.

This choice attaches the public IP to the correct network interface IP configuration. It leaves the specific need to assign an intended stable private address to a VM network interface within its subnet unaddressed.

Although ExpressRoute gateway on VNet connects a VNet to an ExpressRoute circuit through the managed gateway, that is not sufficient to allow an approved cross-subscription connection to an ExpressRoute circuit in this case.

ExpressRoute private peering provides private routing to VNet private address spaces over an ExpressRoute circuit. The current problem instead requires a control that allows an approved cross-subscription connection to an ExpressRoute circuit.

ExpressRoute circuit provisioning creates the provider-backed private connectivity circuit before linking Azure VNets. The current problem instead requires a control that allows an approved cross-subscription connection to an ExpressRoute circuit.

Azure Firewall application rule is useful when the goal is to apply FQDN- or application-aware outbound access controls for supported protocols. Here, the required behavior is to translate an approved public destination address and port to a protected internal service.

Firewall forced tunneling via approved next hop is useful when the goal is to route Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge. Here, the required behavior is to translate an approved public destination address and port to a protected internal service.

That approach centralizes managed firewall settings and reusable rule collections; it does not replace Azure Firewall DNAT rule for the constraint in this scenario.

Although Route-based site-to-site VPN gateway supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device, that is not sufficient to validate routing, NSGs and return paths after IPsec reports connected in this case.

VPN connection status and tunnel diagnostics is useful when the goal is to inspect tunnel state, negotiated parameters and gateway logs before changing routes. Here, the required behavior is to validate routing, NSGs and return paths after IPsec reports connected.

This alternative records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection, which solves a different networking task. It does not directly validate routing, NSGs and return paths after IPsec reports connected.

This choice integrates an endpoint with the appropriate private DNS zone records where supported. It leaves the specific need to map the service's normal FQDN to its private endpoint IP address for authorized clients unaddressed.

This choice uses the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients. It leaves the specific need to map the service's normal FQDN to its private endpoint IP address for authorized clients unaddressed.

Private Endpoint from on-premises via hybrid route is useful when the goal is to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. Here, the required behavior is to map the service's normal FQDN to its private endpoint IP address for authorized clients.

Although Azure Virtual Network Manager connectivity groups centrally coordinates VNet connectivity topology across many subscriptions, that is not sufficient to exchange dynamic routes with supported network virtual appliances over BGP in this case.

Azure Virtual Network Manager security admin rules is useful when the goal is to centrally enforce supported security policies across network groups before workload NSGs. Here, the required behavior is to exchange dynamic routes with supported network virtual appliances over BGP.

That approach reveals which system, BGP or user route determines an actual VM next hop; it does not replace Azure Route Server for BGP exchange for the constraint in this scenario.

Route table association to subnet is useful when the goal is to apply a defined user route collection to the workload subnet. Here, the required behavior is to reveal which system, BGP or user route determines an actual VM next hop.

This choice directs selected subnet traffic to a nominated next-hop NVA address. It leaves the specific need to reveal which system, BGP or user route determines an actual VM next hop unaddressed.

This alternative exchanges dynamic routes with supported network virtual appliances over BGP, which solves a different networking task. It does not directly reveal which system, BGP or user route determines an actual VM next hop.

This alternative applies FQDN- or application-aware outbound access controls for supported protocols, which solves a different networking task. It does not directly organize matching firewall rules with correct ordering and actions.

This alternative provides centrally proxied DNS resolution for supported FQDN-based network policy, which solves a different networking task. It does not directly organize matching firewall rules with correct ordering and actions.

This choice centralizes managed firewall settings and reusable rule collections. It leaves the specific need to organize matching firewall rules with correct ordering and actions unaddressed.

This alternative permits forwarded packets between peered VNets through a hub appliance where appropriate, which solves a different networking task. It does not directly link the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution.

That approach provides scalable managed outbound connectivity for private subnet workloads; it does not replace Private DNS zone access for peered VNets for the constraint in this scenario.

That approach connects two Azure virtual networks over the Microsoft backbone without a VPN appliance; it does not replace Private DNS zone access for peered VNets for the constraint in this scenario.