Microsoft AZ-700 Bundle

This alternative permits forwarded packets between peered VNets through a hub appliance where appropriate, which solves a different networking task. It does not directly link the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution.

That approach provides scalable managed outbound connectivity for private subnet workloads; it does not replace Private DNS zone access for peered VNets for the constraint in this scenario.

That approach connects two Azure virtual networks over the Microsoft backbone without a VPN appliance; it does not replace Private DNS zone access for peered VNets for the constraint in this scenario.

Although Public IP Prefix for contiguous outbound allocation reserves a managed contiguous block of standard public addresses for public IP resources, that is not sufficient to reserve the specifically named subnet required for Azure Bastion in this case.

That approach accounts for Azure-reserved addresses and workload growth in each subnet; it does not replace Dedicated AzureBastionSubnet for the constraint in this scenario.

Service-specific subnet isolation is useful when the goal is to keep dedicated platform subnets separate from shared workload subnets. Here, the required behavior is to reserve the specifically named subnet required for Azure Bastion.

Although Dedicated AzureBastionSubnet reserves the specifically named subnet required for Azure Bastion, that is not sufficient to keep dedicated platform subnets separate from shared workload subnets in this case.

That approach delegates a subnet to a supported service so the platform can manage its integration requirements; it does not replace Service-specific subnet isolation for the constraint in this scenario.

That approach places security and routing policies on the workload subnet rather than assuming a public IP defines security; it does not replace Service-specific subnet isolation for the constraint in this scenario.

Private Endpoint connection state monitoring inspects connection state and service-side approvals during private-link troubleshooting. The current problem instead requires a control that targets the correct service resource and subresource in a private endpoint connection.

Private Endpoint subnet placement is useful when the goal is to deploy a supported private endpoint NIC in the correct consumer VNet subnet. Here, the required behavior is to target the correct service resource and subresource in a private endpoint connection.

Private Endpoint resource-specific authorization scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions. The current problem instead requires a control that targets the correct service resource and subresource in a private endpoint connection.

User-defined route to virtual appliance is useful when the goal is to direct selected subnet traffic to a nominated next-hop NVA address. Here, the required behavior is to check both forward and return routing when traffic crosses a central firewall or appliance.

That approach sends Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop; it does not replace Service chaining return-path validation for the constraint in this scenario.

VNet peering for private backbone connectivity connects two Azure virtual networks over the Microsoft backbone without a VPN appliance. The current problem instead requires a control that checks both forward and return routing when traffic crosses a central firewall or appliance.

On-premises VPN device policy matching is useful when the goal is to align corporate firewall route, access and selector rules with Azure connection design. Here, the required behavior is to handle a restricted legacy VPN peer that relies on specific address selectors.

VPN gateway SKU throughput planning selects a supported VPN gateway tier sized for aggregate tunnels and traffic. The current problem instead requires a control that handles a restricted legacy VPN peer that relies on specific address selectors.

This alternative updates peer and local network gateway settings together during a branch cutover, which solves a different networking task. It does not directly handle a restricted legacy VPN peer that relies on specific address selectors.

This alternative defines a frontend protocol/port and backend pool mapping for distributed connections, which solves a different networking task. It does not directly control SNAT for backend VMs that require outbound connectivity using a load-balancer frontend.

Internal Load Balancer frontend exposes a private VNet IP address for a load-balanced service rather than a public endpoint. The current problem instead requires a control that controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend.

Public Load Balancer frontend provides an Internet-routable Layer 4 frontend for approved external clients. The current problem instead requires a control that controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend.

This alternative places a supported VPN gateway across availability zones for regional resilience, which solves a different networking task. It does not directly support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device.

BGP route advertisement on VPN exchanges dynamic network prefixes over a supported route-based VPN configuration. The current problem instead requires a control that supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device.

This choice aligns corporate firewall route, access and selector rules with Azure connection design. It leaves the specific need to support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device unaddressed.

AzureFirewallSubnet sizing is useful when the goal is to provide the reserved firewall subnet for the managed Azure Firewall deployment. Here, the required behavior is to account for Azure-reserved addresses and workload growth in each subnet.

GatewaySubnet for virtual network gateway allocates the reserved gateway subnet used by Azure VPN or ExpressRoute gateways. The current problem instead requires a control that accounts for Azure-reserved addresses and workload growth in each subnet.

That approach places security and routing policies on the workload subnet rather than assuming a public IP defines security; it does not replace Subnet size and reserved IP planning for the constraint in this scenario.

This alternative permits forwarded packets between peered VNets through a hub appliance where appropriate, which solves a different networking task. It does not directly update peering awareness after VNet address-space changes.

User-defined route to virtual appliance is useful when the goal is to direct selected subnet traffic to a nominated next-hop NVA address. Here, the required behavior is to update peering awareness after VNet address-space changes.

Although Private DNS zone access for peered VNets links the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution, that is not sufficient to update peering awareness after VNet address-space changes in this case.

This alternative restricts workloads initiating network connections toward disallowed destinations, which solves a different networking task. It does not directly restrict traffic entering a NIC or subnet by source, destination and service port.

This choice tests a specified source/destination/port and reports the allowing or blocking NSG rule. It leaves the specific need to restrict traffic entering a NIC or subnet by source, destination and service port unaddressed.

NSG effective rule inspection reads merged effective rules after both subnet and NIC associations. The current problem instead requires a control that restricts traffic entering a NIC or subnet by source, destination and service port.