Microsoft AZ-700 Bundle

Front Door route and origin mapping connects the matching frontend domain/path to the intended origin group. The current problem instead requires a control that selects healthy primary and secondary origins using configured priority and health.

That approach balances requests among equally prioritized healthy origins using configured weights; it does not replace Front Door origin group priority failover for the constraint in this scenario.

Azure Front Door global application delivery provides globally distributed edge entry points with accelerated HTTP/S routing to origins. The current problem instead requires a control that selects healthy primary and secondary origins using configured priority and health.

Private Link service access visibility is useful when the goal is to restrict eligible consumers through controlled visibility and approval settings. Here, the required behavior is to give authorized consumers a service alias to request private endpoints without using the full resource ID.

This alternative scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions, which solves a different networking task. It does not directly give authorized consumers a service alias to request private endpoints without using the full resource ID.

Private Link service provider design is useful when the goal is to expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link. Here, the required behavior is to give authorized consumers a service alias to request private endpoints without using the full resource ID.

This alternative verifies whether the selected PaaS resource type supports service endpoints before planning access, which solves a different networking task. It does not directly permit the specified subnet at the target managed service after a service endpoint is enabled.

That approach checks source subnet configuration, resource firewall rules and actual service reachability; it does not replace PaaS resource firewall VNet rule for the constraint in this scenario.

Although Service endpoint policy subnet binding associates an approved service endpoint policy with the intended endpoint-enabled workload subnet, that is not sufficient to permit the specified subnet at the target managed service after a service endpoint is enabled in this case.

Although Address and subnet allocation inventory tracks CIDR ownership, free space and subnet relationships before deployment, that is not sufficient to prevent address collisions between Azure networks and corporate routes in this case.

This choice accounts for Azure-reserved addresses and workload growth in each subnet. It leaves the specific need to prevent address collisions between Azure networks and corporate routes unaddressed.

Address-prefix growth and readdress planning expands address capacity while managing dependencies and routing effects. The current problem instead requires a control that prevents address collisions between Azure networks and corporate routes.

This choice allows an approved cross-subscription connection to an ExpressRoute circuit. It leaves the specific need to select supported capacity, metering and reach based on enterprise traffic needs unaddressed.

That approach improves data path behavior by bypassing the gateway for supported ExpressRoute data traffic; it does not replace ExpressRoute circuit bandwidth and SKU design for the constraint in this scenario.

Although ExpressRoute circuit provisioning creates the provider-backed private connectivity circuit before linking Azure VNets, that is not sufficient to select supported capacity, metering and reach based on enterprise traffic needs in this case.

Private Endpoint subresource selection is useful when the goal is to target the correct service resource and subresource in a private endpoint connection. Here, the required behavior is to update endpoint connections, DNS and service firewall settings together during a resource move.

This alternative maps the service's normal FQDN to its private endpoint IP address for authorized clients, which solves a different networking task. It does not directly update endpoint connections, DNS and service firewall settings together during a resource move.

This alternative requires the service owner to authorize pending private endpoint connections when necessary, which solves a different networking task. It does not directly update endpoint connections, DNS and service firewall settings together during a resource move.

Although Virtual WAN gateway scale-unit planning sizes a managed virtual-hub gateway for required bandwidth and connections, that is not sufficient to terminate VPN connections from branches within the managed virtual hub in this case.

Standard Virtual WAN for advanced transit is useful when the goal is to support site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology. Here, the required behavior is to terminate VPN connections from branches within the managed virtual hub.

Virtual WAN virtual hub creation deploys a Microsoft-managed regional hub for connectivity, routing and gateway services. The current problem instead requires a control that terminates VPN connections from branches within the managed virtual hub.

This alternative records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection, which solves a different networking task. It does not directly exchange dynamic network prefixes over a supported route-based VPN configuration.

This choice supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device. It leaves the specific need to exchange dynamic network prefixes over a supported route-based VPN configuration unaddressed.

This alternative places a supported VPN gateway across availability zones for regional resilience, which solves a different networking task. It does not directly exchange dynamic network prefixes over a supported route-based VPN configuration.

IP flow verify for NSG traffic decision tests a specified source/destination/port and reports the allowing or blocking NSG rule. The current problem instead requires a control that restricts workloads initiating network connections toward disallowed destinations.

This alternative restricts traffic entering a NIC or subnet by source, destination and service port, which solves a different networking task. It does not directly restrict workloads initiating network connections toward disallowed destinations.

This choice applies additional instance-specific NSG rules to a selected network interface. It leaves the specific need to restrict workloads initiating network connections toward disallowed destinations unaddressed.

Although Azure Virtual Network Manager connectivity groups centrally coordinates VNet connectivity topology across many subscriptions, that is not sufficient to update peering awareness after VNet address-space changes in this case.

This choice connects two Azure virtual networks over the Microsoft backbone without a VPN appliance. It leaves the specific need to update peering awareness after VNet address-space changes unaddressed.

Although Private DNS zone access for peered VNets links the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution, that is not sufficient to update peering awareness after VNet address-space changes in this case.

WAF diagnostic logging and investigation correlates WAF rule IDs, policy actions and client requests to investigate web filtering. The current problem instead requires a control that matches an application-specific condition such as an approved IP, header or path and applies policy.

Although WAF policy association to listener or domain binds the WAF policy to the supported application gateway listener or edge domain, that is not sufficient to match an application-specific condition such as an approved IP, header or path and applies policy in this case.

Although WAF on Application Gateway for regional web protection inspects HTTP/S requests at a regional application gateway using supported WAF policies, that is not sufficient to match an application-specific condition such as an approved IP, header or path and applies policy in this case.