Microsoft AZ-700 Bundle

This alternative restricts workloads initiating network connections toward disallowed destinations, which solves a different networking task. It does not directly restrict traffic entering a NIC or subnet by source, destination and service port.

This choice tests a specified source/destination/port and reports the allowing or blocking NSG rule. It leaves the specific need to restrict traffic entering a NIC or subnet by source, destination and service port unaddressed.

NSG effective rule inspection reads merged effective rules after both subnet and NIC associations. The current problem instead requires a control that restricts traffic entering a NIC or subnet by source, destination and service port.

That approach applies additional instance-specific NSG rules to a selected network interface; it does not replace NSG effective rule inspection for the constraint in this scenario.

NSG subnet association applies a network security group to all eligible network interfaces in a selected subnet. The current problem instead requires a control that reads merged effective rules after both subnet and NIC associations.

Although NSG inbound rule source and port restricts traffic entering a NIC or subnet by source, destination and service port, that is not sufficient to read merged effective rules after both subnet and NIC associations in this case.

That approach advertises or includes the correct private destination prefixes in remote-user VPN profiles; it does not replace P2S client address pool planning for the constraint in this scenario.

This alternative checks identity, certificates and local profile logs before changing gateway routes, which solves a different networking task. It does not directly allocate remote-user tunnel addresses without overlapping VNet and on-premises ranges.

Point-to-site VPN for individual users provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel. The current problem instead requires a control that allocates remote-user tunnel addresses without overlapping VNet and on-premises ranges.

This alternative connects the matching frontend domain/path to the intended origin group, which solves a different networking task. It does not directly configure an approved domain, DNS validation and certificate for the edge endpoint.

Although Front Door Rules Engine redirect returns an HTTP redirect to the client for an approved URL transformation, that is not sufficient to configure an approved domain, DNS validation and certificate for the edge endpoint in this case.

Although Front Door origin health probe checks origin availability from the edge to exclude unhealthy backends, that is not sufficient to configure an approved domain, DNS validation and certificate for the edge endpoint in this case.

Although VNet service endpoint enablement extends selected Azure service routing and service identity from an approved VNet subnet, that is not sufficient to permit the specified subnet at the target managed service after a service endpoint is enabled in this case.

This alternative checks source subnet configuration, resource firewall rules and actual service reachability, which solves a different networking task. It does not directly permit the specified subnet at the target managed service after a service endpoint is enabled.

Service endpoint policy subnet binding is useful when the goal is to associate an approved service endpoint policy with the intended endpoint-enabled workload subnet. Here, the required behavior is to permit the specified subnet at the target managed service after a service endpoint is enabled.

Although Azure Firewall Standard for stateful filtering provides managed stateful network and application filtering without Premium-only inspection, that is not sufficient to use the Premium tier's supported TLS inspection and advanced threat features in this case.

Secure Virtual WAN hub with Azure Firewall is useful when the goal is to deploy Azure Firewall into a supported Virtual WAN virtual hub for managed inspection. Here, the required behavior is to use the Premium tier's supported TLS inspection and advanced threat features.

This choice uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic. It leaves the specific need to use the Premium tier's supported TLS inspection and advanced threat features unaddressed.

VPN client device deployment validation is useful when the goal is to validate supported OS, client version, tunnel profile and endpoint requirements. Here, the required behavior is to deliver the correct gateway endpoints, routes and authentication settings to client devices.

This choice uses an existing supported RADIUS server for VPN user authentication. It leaves the specific need to deliver the correct gateway endpoints, routes and authentication settings to client devices unaddressed.

P2S client-side authentication troubleshooting checks identity, certificates and local profile logs before changing gateway routes. The current problem instead requires a control that delivers the correct gateway endpoints, routes and authentication settings to client devices.

This alternative inspects HTTP/S requests at a regional application gateway using supported WAF policies, which solves a different networking task. It does not directly match an application-specific condition such as an approved IP, header or path and applies policy.

Managed WAF rule set selection is useful when the goal is to use a supported managed web attack signature rule set for common application threats. Here, the required behavior is to match an application-specific condition such as an approved IP, header or path and applies policy.

This alternative correlates WAF rule IDs, policy actions and client requests to investigate web filtering, which solves a different networking task. It does not directly match an application-specific condition such as an approved IP, header or path and applies policy.

That approach creates the provider-backed private connectivity circuit before linking Azure VNets; it does not replace ExpressRoute encryption over private connectivity for the constraint in this scenario.

ExpressRoute private peering provides private routing to VNet private address spaces over an ExpressRoute circuit. The current problem instead requires a control that adds a supported encryption overlay when private circuit transport alone is insufficient.

That approach connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity; it does not replace ExpressRoute encryption over private connectivity for the constraint in this scenario.

Private Endpoint migration cutover updates endpoint connections, DNS and service firewall settings together during a resource move. The current problem instead requires a control that requires the service owner to authorize pending private endpoint connections when necessary.

Although Private Endpoint subresource selection targets the correct service resource and subresource in a private endpoint connection, that is not sufficient to require the service owner to authorize pending private endpoint connections when necessary in this case.

Private Endpoint from on-premises via hybrid route uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. The current problem instead requires a control that requires the service owner to authorize pending private endpoint connections when necessary.

That approach provides private routing to VNet private address spaces over an ExpressRoute circuit; it does not replace ExpressRoute encryption over private connectivity for the constraint in this scenario.

Although ExpressRoute circuit authorization allows an approved cross-subscription connection to an ExpressRoute circuit, that is not sufficient to add a supported encryption overlay when private circuit transport alone is insufficient in this case.

Although ExpressRoute circuit provisioning creates the provider-backed private connectivity circuit before linking Azure VNets, that is not sufficient to add a supported encryption overlay when private circuit transport alone is insufficient in this case.