Microsoft AZ-700 Bundle

This alternative provides managed stateful network and application filtering without Premium-only inspection, which solves a different networking task. It does not directly provide centrally proxied DNS resolution for supported FQDN-based network policy.

This alternative permits or denies supported IP-based TCP or UDP flows by addresses and ports, which solves a different networking task. It does not directly provide centrally proxied DNS resolution for supported FQDN-based network policy.

Azure Firewall Manager for fleet governance manages and monitors multiple cloud firewalls and supported secure hubs centrally. The current problem instead requires a control that provides centrally proxied DNS resolution for supported FQDN-based network policy.

This choice connects the matching frontend domain/path to the intended origin group. It leaves the specific need to configure an approved domain, DNS validation and certificate for the edge endpoint unaddressed.

Front Door end-to-end TLS protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings. The current problem instead requires a control that configures an approved domain, DNS validation and certificate for the edge endpoint.

Front Door origin health probe checks origin availability from the edge to exclude unhealthy backends. The current problem instead requires a control that configures an approved domain, DNS validation and certificate for the edge endpoint.

Although Traffic Manager endpoint health monitoring uses endpoint status probes to determine which DNS endpoints remain eligible, that is not sufficient to test a configured probe endpoint or port to determine eligible healthy backends in this case.

This alternative uses the current supported load balancer SKU with configurable health and security behavior, which solves a different networking task. It does not directly test a configured probe endpoint or port to determine eligible healthy backends.

This alternative maps a selected frontend IP and port to an individual backend VM and port, which solves a different networking task. It does not directly test a configured probe endpoint or port to determine eligible healthy backends.

Private Link service access visibility controls eligible subscriptions for a provider-hosted Private Link Service; it does not confirm this endpoint’s existing storage target.

Private Link service provider design is for privately publishing a provider service, not inspecting an already-created storage endpoint target.

Adding an unrelated subresource does not verify the current endpoint target and may introduce a needless second connection.

Although Cross-region Azure Load Balancer design uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency, that is not sufficient to distribute TCP or UDP flows to healthy backend instances in an Azure region in this case.

Azure Traffic Manager DNS routing chooses between geographically distributed public endpoints through DNS responses. The current problem instead requires a control that distributes TCP or UDP flows to healthy backend instances in an Azure region.

Load Balancer HA ports is useful when the goal is to enable a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. Here, the required behavior is to distribute TCP or UDP flows to healthy backend instances in an Azure region.

This choice references application security groups as source or destination in supported NSG rules. It leaves the specific need to group VM interfaces by application role for NSG rule targeting unaddressed.

NSG subnet association is useful when the goal is to apply a network security group to all eligible network interfaces in a selected subnet. Here, the required behavior is to group VM interfaces by application role for NSG rule targeting.

IP flow verify for NSG traffic decision is useful when the goal is to test a specified source/destination/port and reports the allowing or blocking NSG rule. Here, the required behavior is to group VM interfaces by application role for NSG rule targeting.

Although Virtual WAN virtual hub creation deploys a Microsoft-managed regional hub for connectivity, routing and gateway services, that is not sufficient to integrate managed central security inspection into a Virtual WAN virtual hub in this case.

This alternative sizes a managed virtual-hub gateway for required bandwidth and connections, which solves a different networking task. It does not directly integrate managed central security inspection into a Virtual WAN virtual hub.

Although Virtual WAN site-to-site VPN gateway terminates VPN connections from branches within the managed virtual hub, that is not sufficient to integrate managed central security inspection into a Virtual WAN virtual hub in this case.

This alternative tests a specified source/destination/port and reports the allowing or blocking NSG rule, which solves a different networking task. It does not directly capture supported virtual network flow data for operational and security analysis.

Azure Virtual Network Manager security admin policy is useful when the goal is to govern supported high-priority security admin rules across centrally managed VNets. Here, the required behavior is to capture supported virtual network flow data for operational and security analysis.

Although NSG subnet association applies a network security group to all eligible network interfaces in a selected subnet, that is not sufficient to capture supported virtual network flow data for operational and security analysis in this case.

This choice searches security and resource context to find network assets matching risk conditions. It leaves the specific need to send supported network resource logs to a workspace for query and retention unaddressed.

That approach captures scoped packet evidence from a supported VM for protocol troubleshooting; it does not replace Azure diagnostic settings to Log Analytics for the constraint in this scenario.

This alternative collects performance and health signals for Azure networking resources, which solves a different networking task. It does not directly send supported network resource logs to a workspace for query and retention.

Static private NIC IP configuration is useful when the goal is to assign an intended stable private address to a VM network interface within its subnet. Here, the required behavior is to assign a routable public endpoint to a specified Azure resource when direct exposure is justified.

This alternative reserves a managed contiguous block of standard public addresses for public IP resources, which solves a different networking task. It does not directly assign a routable public endpoint to a specified Azure resource when direct exposure is justified.

That approach selects the supported public IP SKU and zone behavior for the intended resource and region; it does not replace Standard Public IP for internet-facing VM for the constraint in this scenario.

Front Door route and origin mapping connects the matching frontend domain/path to the intended origin group. The current problem instead requires a control that selects healthy primary and secondary origins using configured priority and health.

That approach balances requests among equally prioritized healthy origins using configured weights; it does not replace Front Door origin group priority failover for the constraint in this scenario.

Azure Front Door global application delivery provides globally distributed edge entry points with accelerated HTTP/S routing to origins. The current problem instead requires a control that selects healthy primary and secondary origins using configured priority and health.