Microsoft AZ-700 Bundle

This alternative chooses a supported SSL/TLS-based VPN client protocol for broad client compatibility, which solves a different networking task. It does not directly deliver the correct gateway endpoints, routes and authentication settings to client devices.

P2S client-side authentication troubleshooting checks identity, certificates and local profile logs before changing gateway routes. The current problem instead requires a control that delivers the correct gateway endpoints, routes and authentication settings to client devices.

VPN client device deployment validation validates supported OS, client version, tunnel profile and endpoint requirements. The current problem instead requires a control that delivers the correct gateway endpoints, routes and authentication settings to client devices.

This alternative defines application servers, scale sets or FQDN destinations receiving proxied requests, which solves a different networking task. It does not directly re-encrypt or retains HTTPS between the gateway and validated backend endpoints.

Although Application Gateway TLS termination terminates client HTTPS on the gateway with the appropriate certificate and listener, that is not sufficient to re-encrypt or retains HTTPS between the gateway and validated backend endpoints in this case.

Although Application Gateway HTTP settings configures supported backend protocol, port, host-name and session behavior, that is not sufficient to re-encrypt or retains HTTPS between the gateway and validated backend endpoints in this case.

Although Application Gateway autoscale adjusts supported v2 gateway capacity automatically to demand within configured boundaries, that is not sufficient to configure supported backend protocol, port, host-name and session behavior in this case.

This choice defines application servers, scale sets or FQDN destinations receiving proxied requests. It leaves the specific need to configure supported backend protocol, port, host-name and session behavior unaddressed.

Application Gateway HTTP listener matches incoming protocol, port and optional host name before routing requests. The current problem instead requires a control that configures supported backend protocol, port, host-name and session behavior.

This choice selects the intended backend network interfaces or IPs that receive distributed traffic. It leaves the specific need to define a frontend protocol/port and backend pool mapping for distributed connections unaddressed.

Load Balancer outbound rule controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend. The current problem instead requires a control that defines a frontend protocol/port and backend pool mapping for distributed connections.

That approach maps a selected frontend IP and port to an individual backend VM and port; it does not replace Load Balancer load-balancing rule for the constraint in this scenario.

This alternative tests authoritative records, zone links and conditional forwarding in the proper order, which solves a different networking task. It does not directly link a forwarding ruleset to the VNets that need to use it.

This choice permits a selected VNet's resolver to query records in a private DNS zone. It leaves the specific need to link a forwarding ruleset to the VNets that need to use it unaddressed.

That approach matches a domain suffix and forwards queries to designated DNS target servers; it does not replace Ruleset VNet association for the constraint in this scenario.

Virtual WAN virtual hub creation is useful when the goal is to deploy a Microsoft-managed regional hub for connectivity, routing and gateway services. Here, the required behavior is to attache a workload VNet to a managed virtual hub for connectivity and route propagation.

Virtual WAN secure hub with Azure Firewall is useful when the goal is to integrate managed central security inspection into a Virtual WAN virtual hub. Here, the required behavior is to attache a workload VNet to a managed virtual hub for connectivity and route propagation.

This alternative defines which routes are advertised into selected hub route tables and connection groups, which solves a different networking task. It does not directly attache a workload VNet to a managed virtual hub for connectivity and route propagation.

Network Watcher packet capture is useful when the goal is to capture scoped packet evidence from a supported VM for protocol troubleshooting. Here, the required behavior is to determine a VM's effective route and next-hop category to a destination.

Network Watcher connection troubleshoot tests end-to-end reachability, latency and network obstacles between source and destination. The current problem instead requires a control that determines a VM's effective route and next-hop category to a destination.

Network Watcher effective security rules is useful when the goal is to list the combined network security rules effective on an Azure VM interface. Here, the required behavior is to determine a VM's effective route and next-hop category to a destination.

WAF policy association to listener or domain is useful when the goal is to bind the WAF policy to the supported application gateway listener or edge domain. Here, the required behavior is to inspect web traffic at Microsoft's global edge before it reaches regional origins.

This alternative inspects HTTP/S requests at a regional application gateway using supported WAF policies, which solves a different networking task. It does not directly inspect web traffic at Microsoft's global edge before it reaches regional origins.

This alternative logs matching malicious patterns without blocking legitimate traffic during a controlled baseline, which solves a different networking task. It does not directly inspect web traffic at Microsoft's global edge before it reaches regional origins.

This alternative correlates WAF rule IDs, policy actions and client requests to investigate web filtering, which solves a different networking task. It does not directly inspect web traffic at Microsoft's global edge before it reaches regional origins.

WAF policy association to listener or domain binds the WAF policy to the supported application gateway listener or edge domain. The current problem instead requires a control that inspects web traffic at Microsoft's global edge before it reaches regional origins.

Although WAF on Application Gateway for regional web protection inspects HTTP/S requests at a regional application gateway using supported WAF policies, that is not sufficient to inspect web traffic at Microsoft's global edge before it reaches regional origins in this case.

That approach delivers the correct gateway endpoints, routes and authentication settings to client devices; it does not replace P2S OpenVPN protocol selection for the constraint in this scenario.

Although VPN client device deployment validation validates supported OS, client version, tunnel profile and endpoint requirements, that is not sufficient to choose a supported SSL/TLS-based VPN client protocol for broad client compatibility in this case.

This alternative uses an existing supported RADIUS server for VPN user authentication, which solves a different networking task. It does not directly choose a supported SSL/TLS-based VPN client protocol for broad client compatibility.

ASG-based NSG access rule references application security groups as source or destination in supported NSG rules. The current problem instead requires a control that limits administrative connections to approved sources and ports rather than Internet-wide access.

This choice restricts workloads initiating network connections toward disallowed destinations. It leaves the specific need to limit administrative connections to approved sources and ports rather than Internet-wide access unaddressed.

This choice provides managed remote VM access without exposing RDP or SSH public IPs on each VM. It leaves the specific need to limit administrative connections to approved sources and ports rather than Internet-wide access unaddressed.