Microsoft AZ-700 Bundle

Although Azure Firewall Policy across regions centralizes managed firewall settings and reusable rule collections, that is not sufficient to translate an approved public destination address and port to a protected internal service in this case.

Firewall forced tunneling via approved next hop routes Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge. The current problem instead requires a control that translates an approved public destination address and port to a protected internal service.

Although Azure Firewall network rule permits or denies supported IP-based TCP or UDP flows by addresses and ports, that is not sufficient to translate an approved public destination address and port to a protected internal service in this case.

This choice uses host-based listeners to select application backends for different domain names. It leaves the specific need to check an application-specific path and expected response before including backends unaddressed.

This alternative terminates client HTTPS on the gateway with the appropriate certificate and listener, which solves a different networking task. It does not directly check an application-specific path and expected response before including backends.

That approach selects different backends based on URL path patterns; it does not replace Application Gateway custom health probe for the constraint in this scenario.

WAF diagnostic logging and investigation correlates WAF rule IDs, policy actions and client requests to investigate web filtering. The current problem instead requires a control that uses a supported managed web attack signature rule set for common application threats.

This choice inspects HTTP/S requests at a regional application gateway using supported WAF policies. It leaves the specific need to use a supported managed web attack signature rule set for common application threats unaddressed.

This choice narrows a proven harmless match while retaining the remainder of managed protections. It leaves the specific need to use a supported managed web attack signature rule set for common application threats unaddressed.

That approach deploys a Microsoft-managed regional hub for connectivity, routing and gateway services; it does not replace Standard Virtual WAN for advanced transit for the constraint in this scenario.

That approach terminates VPN connections from branches within the managed virtual hub; it does not replace Standard Virtual WAN for advanced transit for the constraint in this scenario.

Although Virtual WAN secure hub with Azure Firewall integrates managed central security inspection into a Virtual WAN virtual hub, that is not sufficient to support site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology in this case.

That approach groups VM interfaces by application role for NSG rule targeting; it does not replace NSG rule priority and first-match evaluation for the constraint in this scenario.

This alternative tests a specified source/destination/port and reports the allowing or blocking NSG rule, which solves a different networking task. It does not directly ensure a more specific permitted or denied flow is evaluated in the intended priority order.

This choice governs supported high-priority security admin rules across centrally managed VNets. It leaves the specific need to ensure a more specific permitted or denied flow is evaluated in the intended priority order unaddressed.

DNS forwarding ruleset and rules matches a domain suffix and forwards queries to designated DNS target servers. The current problem instead requires a control that directs VNet-resident clients to selected DNS servers for specialized resolution.

This alternative permits a selected VNet's resolver to query records in a private DNS zone, which solves a different networking task. It does not directly direct VNet-resident clients to selected DNS servers for specialized resolution.

This choice sends selected Azure DNS queries toward other DNS servers through managed forwarding. It leaves the specific need to direct VNet-resident clients to selected DNS servers for specialized resolution unaddressed.

That approach connects the matching frontend domain/path to the intended origin group; it does not replace Front Door Rules Engine rewrite for the constraint in this scenario.

This alternative protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings, which solves a different networking task. It does not directly change the upstream URL path while the client's visible URL remains stable.

That approach returns an HTTP redirect to the client for an approved URL transformation; it does not replace Front Door Rules Engine rewrite for the constraint in this scenario.

This alternative groups VM interfaces by application role for NSG rule targeting, which solves a different networking task. It does not directly reference application security groups as source or destination in supported NSG rules.

That approach tests a specified source/destination/port and reports the allowing or blocking NSG rule; it does not replace ASG-based NSG access rule for the constraint in this scenario.

NSG network interface association applies additional instance-specific NSG rules to a selected network interface. The current problem instead requires a control that references application security groups as source or destination in supported NSG rules.

Azure Bastion for browser-based VM administration is useful when the goal is to provide managed remote VM access without exposing RDP or SSH public IPs on each VM. Here, the required behavior is to limit administrative connections to approved sources and ports rather than Internet-wide access.

That approach restricts workloads initiating network connections toward disallowed destinations; it does not replace NSG remote management least privilege for the constraint in this scenario.

NSG network interface association applies additional instance-specific NSG rules to a selected network interface. The current problem instead requires a control that limits administrative connections to approved sources and ports rather than Internet-wide access.

That approach uses the Premium tier's supported TLS inspection and advanced threat features; it does not replace Azure Firewall Basic for simple network filtering for the constraint in this scenario.

Although Firewall forced tunneling via approved next hop routes Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge, that is not sufficient to fit eligible smaller workloads when advanced throughput and security features are not required in this case.

Although Azure Firewall Standard for stateful filtering provides managed stateful network and application filtering without Premium-only inspection, that is not sufficient to fit eligible smaller workloads when advanced throughput and security features are not required in this case.

This alternative stores DNS records visible through linked private-network resolution rather than public DNS, which solves a different networking task. It does not directly host authoritative public DNS records under an internet-resolvable zone.

Azure DNS Private Resolver outbound endpoint sends selected Azure DNS queries toward other DNS servers through managed forwarding. The current problem instead requires a control that hosts authoritative public DNS records under an internet-resolvable zone.

This alternative permits a selected VNet's resolver to query records in a private DNS zone, which solves a different networking task. It does not directly host authoritative public DNS records under an internet-resolvable zone.