Microsoft AZ-700 Bundle

VPN client device deployment validation validates supported OS, client version, tunnel profile and endpoint requirements. The current problem instead requires a control that provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel.

P2S client address pool planning allocates remote-user tunnel addresses without overlapping VNet and on-premises ranges. The current problem instead requires a control that provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel.

P2S gateway SKU and concurrent-user limits sizes point-to-site connectivity for the expected simultaneous remote clients. The current problem instead requires a control that provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel.

Standard Public IP for internet-facing VM assigns a routable public endpoint to a specified Azure resource when direct exposure is justified. The current problem instead requires a control that assigns an intended stable private address to a VM network interface within its subnet.

Although Private IP allocation consistency across NICs ensures private addresses belong to the selected subnet and interface configuration, that is not sufficient to assign an intended stable private address to a VM network interface within its subnet in this case.

That approach uses multiple supported IP configurations on a network interface for distinct service addresses; it does not replace Static private NIC IP configuration for the constraint in this scenario.

Application Security Group membership groups VM interfaces by application role for NSG rule targeting. The current problem instead requires a control that applies a network security group to all eligible network interfaces in a selected subnet.

This choice restricts traffic entering a NIC or subnet by source, destination and service port. It leaves the specific need to apply a network security group to all eligible network interfaces in a selected subnet unaddressed.

Although NSG network interface association applies additional instance-specific NSG rules to a selected network interface, that is not sufficient to apply a network security group to all eligible network interfaces in a selected subnet in this case.

Although Application Gateway TLS termination terminates client HTTPS on the gateway with the appropriate certificate and listener, that is not sufficient to provide managed regional Layer 7 routing, TLS termination and web traffic distribution in this case.

That approach uses host-based listeners to select application backends for different domain names; it does not replace Application Gateway for regional HTTP routing for the constraint in this scenario.

Application Gateway HTTP listener matches incoming protocol, port and optional host name before routing requests. The current problem instead requires a control that provides managed regional Layer 7 routing, TLS termination and web traffic distribution.

This alternative integrates an endpoint with the appropriate private DNS zone records where supported, which solves a different networking task. It does not directly update endpoint connections, DNS and service firewall settings together during a resource move.

This alternative requires the service owner to authorize pending private endpoint connections when necessary, which solves a different networking task. It does not directly update endpoint connections, DNS and service firewall settings together during a resource move.

This choice maps the service's normal FQDN to its private endpoint IP address for authorized clients. It leaves the specific need to update endpoint connections, DNS and service firewall settings together during a resource move unaddressed.

This alternative allocates the reserved gateway subnet used by Azure VPN or ExpressRoute gateways, which solves a different networking task. It does not directly account for Azure-reserved addresses and workload growth in each subnet.

Although AzureFirewallSubnet sizing provides the reserved firewall subnet for the managed Azure Firewall deployment, that is not sufficient to account for Azure-reserved addresses and workload growth in each subnet in this case.

This alternative expands address capacity while managing dependencies and routing effects, which solves a different networking task. It does not directly account for Azure-reserved addresses and workload growth in each subnet.

That approach tests a specified source/destination/port and reports the allowing or blocking NSG rule; it does not replace NSG outbound rule destination and port for the constraint in this scenario.

NSG subnet association applies a network security group to all eligible network interfaces in a selected subnet. The current problem instead requires a control that restricts workloads initiating network connections toward disallowed destinations.

Although NSG inbound rule source and port restricts traffic entering a NIC or subnet by source, destination and service port, that is not sufficient to restrict workloads initiating network connections toward disallowed destinations in this case.

This choice requires appropriate VPN, ExpressRoute or peering connectivity before remote networks can route to a private endpoint IP. It leaves the specific need to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint unaddressed.

Private Endpoint hostname-specific TLS handling is useful when the goal is to use the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients. Here, the required behavior is to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint.

That approach integrates an endpoint with the appropriate private DNS zone records where supported; it does not replace Private Endpoint from on-premises via hybrid route for the constraint in this scenario.

This choice enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. It leaves the specific need to distribute TCP or UDP flows to healthy backend instances in an Azure region unaddressed.

This choice uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency. It leaves the specific need to distribute TCP or UDP flows to healthy backend instances in an Azure region unaddressed.

Although Load Balancer outbound rule controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend, that is not sufficient to distribute TCP or UDP flows to healthy backend instances in an Azure region in this case.

Virtual WAN virtual hub creation is useful when the goal is to deploy a Microsoft-managed regional hub for connectivity, routing and gateway services. Here, the required behavior is to deploy a supported third-party network virtual appliance in the managed hub solution.

Virtual WAN site-to-site VPN gateway is useful when the goal is to terminate VPN connections from branches within the managed virtual hub. Here, the required behavior is to deploy a supported third-party network virtual appliance in the managed hub solution.

This choice integrates managed central security inspection into a Virtual WAN virtual hub. It leaves the specific need to deploy a supported third-party network virtual appliance in the managed hub solution unaddressed.

That approach routes Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge; it does not replace Azure Firewall DNAT rule for the constraint in this scenario.

This alternative applies FQDN- or application-aware outbound access controls for supported protocols, which solves a different networking task. It does not directly translate an approved public destination address and port to a protected internal service.

Although Azure Firewall policy rule collection priority organizes matching firewall rules with correct ordering and actions, that is not sufficient to translate an approved public destination address and port to a protected internal service in this case.