Microsoft AZ-700 Bundle

WAF diagnostic logging and investigation correlates WAF rule IDs, policy actions and client requests to investigate web filtering. The current problem instead requires a control that matches an application-specific condition such as an approved IP, header or path and applies policy.

Although WAF policy association to listener or domain binds the WAF policy to the supported application gateway listener or edge domain, that is not sufficient to match an application-specific condition such as an approved IP, header or path and applies policy in this case.

Although WAF on Application Gateway for regional web protection inspects HTTP/S requests at a regional application gateway using supported WAF policies, that is not sufficient to match an application-specific condition such as an approved IP, header or path and applies policy in this case.

That approach tests authoritative records, zone links and conditional forwarding in the proper order; it does not replace Azure DNS public zone delegation for the constraint in this scenario.

This choice stores DNS records visible through linked private-network resolution rather than public DNS. It leaves the specific need to host authoritative public DNS records under an internet-resolvable zone unaddressed.

This choice registers eligible VM DNS records automatically in a linked private DNS zone. It leaves the specific need to host authoritative public DNS records under an internet-resolvable zone unaddressed.

This choice collects performance and health signals for Azure networking resources. It leaves the specific need to prioritize cloud security posture findings including exposed network resources unaddressed.

That approach searches security and resource context to find network assets matching risk conditions; it does not replace Defender for Cloud Secure Score recommendations for the constraint in this scenario.

This alternative identifies exploitable attack paths that connect exposure and privilege to important assets, which solves a different networking task. It does not directly prioritize cloud security posture findings including exposed network resources.

That approach onboards an organization's eligible public IPv4 address block into Azure; it does not replace Standard Public IP for internet-facing VM for the constraint in this scenario.

Public IP Prefix for contiguous outbound allocation reserves a managed contiguous block of standard public addresses for public IP resources. The current problem instead requires a control that assigns a routable public endpoint to a specified Azure resource when direct exposure is justified.

Public IP SKU and zone suitability is useful when the goal is to select the supported public IP SKU and zone behavior for the intended resource and region. Here, the required behavior is to assign a routable public endpoint to a specified Azure resource when direct exposure is justified.

Service endpoint policy subnet binding associates an approved service endpoint policy with the intended endpoint-enabled workload subnet. The current problem instead requires a control that checks source subnet configuration, resource firewall rules and actual service reachability.

Service endpoint public address distinction retains public service endpoint addressing while changing private subnet routing and service firewall identity. The current problem instead requires a control that checks source subnet configuration, resource firewall rules and actual service reachability.

PaaS resource firewall VNet rule is useful when the goal is to permit the specified subnet at the target managed service after a service endpoint is enabled. Here, the required behavior is to check source subnet configuration, resource firewall rules and actual service reachability.

ASG-based NSG access rule is useful when the goal is to reference application security groups as source or destination in supported NSG rules. Here, the required behavior is to govern supported high-priority security admin rules across centrally managed VNets.

That approach ensures a more specific permitted or denied flow is evaluated in the intended priority order; it does not replace Azure Virtual Network Manager security admin policy for the constraint in this scenario.

This choice captures supported virtual network flow data for operational and security analysis. It leaves the specific need to govern supported high-priority security admin rules across centrally managed VNets unaddressed.

Application Gateway URL rewrite rule modifies a supported request or response header or URL before upstream routing. The current problem instead requires a control that adjusts supported v2 gateway capacity automatically to demand within configured boundaries.

Application Gateway TLS termination terminates client HTTPS on the gateway with the appropriate certificate and listener. The current problem instead requires a control that adjusts supported v2 gateway capacity automatically to demand within configured boundaries.

Although Application Gateway HTTP settings configures supported backend protocol, port, host-name and session behavior, that is not sufficient to adjust supported v2 gateway capacity automatically to demand within configured boundaries in this case.

This alternative references application security groups as source or destination in supported NSG rules, which solves a different networking task. It does not directly restrict traffic entering a NIC or subnet by source, destination and service port.

Although IP flow verify for NSG traffic decision tests a specified source/destination/port and reports the allowing or blocking NSG rule, that is not sufficient to restrict traffic entering a NIC or subnet by source, destination and service port in this case.

NSG effective rule inspection is useful when the goal is to read merged effective rules after both subnet and NIC associations. Here, the required behavior is to restrict traffic entering a NIC or subnet by source, destination and service port.

ExpressRoute encryption over private connectivity is useful when the goal is to add a supported encryption overlay when private circuit transport alone is insufficient. Here, the required behavior is to connect on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity.

ExpressRoute circuit provisioning creates the provider-backed private connectivity circuit before linking Azure VNets. The current problem instead requires a control that connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity.

ExpressRoute gateway on VNet is useful when the goal is to connect a VNet to an ExpressRoute circuit through the managed gateway. Here, the required behavior is to connect on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity.

Although Private Endpoint subnet placement deploys a supported private endpoint NIC in the correct consumer VNet subnet, that is not sufficient to expose a supported Azure service through a private IP interface in the consumer VNet in this case.

Private Endpoint hostname-specific TLS handling is useful when the goal is to use the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients. Here, the required behavior is to expose a supported Azure service through a private IP interface in the consumer VNet.

Although Private Link service provider design exposes a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link, that is not sufficient to expose a supported Azure service through a private IP interface in the consumer VNet in this case.

This alternative reserves a managed contiguous block of standard public addresses for public IP resources, which solves a different networking task. It does not directly onboard an organization's eligible public IPv4 address block into Azure.

This choice selects the supported public IP SKU and zone behavior for the intended resource and region. It leaves the specific need to onboard an organization's eligible public IPv4 address block into Azure unaddressed.

This alternative attaches the public IP to the correct network interface IP configuration, which solves a different networking task. It does not directly onboard an organization's eligible public IPv4 address block into Azure.