Microsoft AZ-700 Bundle

This alternative stores DNS records visible through linked private-network resolution rather than public DNS, which solves a different networking task. It does not directly host authoritative public DNS records under an internet-resolvable zone.

Azure DNS Private Resolver outbound endpoint sends selected Azure DNS queries toward other DNS servers through managed forwarding. The current problem instead requires a control that hosts authoritative public DNS records under an internet-resolvable zone.

This alternative permits a selected VNet's resolver to query records in a private DNS zone, which solves a different networking task. It does not directly host authoritative public DNS records under an internet-resolvable zone.

Private DNS zone VNet link permits a selected VNet's resolver to query records in a private DNS zone. The current problem instead requires a control that registers eligible VM DNS records automatically in a linked private DNS zone.

This choice stores DNS records visible through linked private-network resolution rather than public DNS. It leaves the specific need to register eligible VM DNS records automatically in a linked private DNS zone unaddressed.

This choice confirms private service FQDNs resolve to the intended private endpoint addresses. It leaves the specific need to register eligible VM DNS records automatically in a linked private DNS zone unaddressed.

This choice connects an eligible Front Door Premium origin privately without exposing it broadly. It leaves the specific need to check origin availability from the edge to exclude unhealthy backends unaddressed.

Front Door origin group priority failover is useful when the goal is to select healthy primary and secondary origins using configured priority and health. Here, the required behavior is to check origin availability from the edge to exclude unhealthy backends.

Although Front Door end-to-end TLS protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings, that is not sufficient to check origin availability from the edge to exclude unhealthy backends in this case.

Front Door origin health probe checks origin availability from the edge to exclude unhealthy backends. The current problem instead requires a control that balances requests among equally prioritized healthy origins using configured weights.

Front Door origin group priority failover selects healthy primary and secondary origins using configured priority and health. The current problem instead requires a control that balances requests among equally prioritized healthy origins using configured weights.

Although Azure Front Door global application delivery provides globally distributed edge entry points with accelerated HTTP/S routing to origins, that is not sufficient to balance requests among equally prioritized healthy origins using configured weights in this case.

That approach configures an approved domain, DNS validation and certificate for the edge endpoint; it does not replace Front Door Rules Engine redirect for the constraint in this scenario.

That approach changes the upstream URL path while the client's visible URL remains stable; it does not replace Front Door Rules Engine redirect for the constraint in this scenario.

Azure Front Door global application delivery provides globally distributed edge entry points with accelerated HTTP/S routing to origins. The current problem instead requires a control that returns an HTTP redirect to the client for an approved URL transformation.

Although User-defined route to virtual appliance directs selected subnet traffic to a nominated next-hop NVA address, that is not sufficient to centrally enforce supported security policies across network groups before workload NSGs in this case.

This choice exchanges dynamic routes with supported network virtual appliances over BGP. It leaves the specific need to centrally enforce supported security policies across network groups before workload NSGs unaddressed.

Azure Virtual Network Manager connectivity groups centrally coordinates VNet connectivity topology across many subscriptions. The current problem instead requires a control that centrally enforces supported security policies across network groups before workload NSGs.

This choice permits or denies supported IP-based TCP or UDP flows by addresses and ports. It leaves the specific need to place Azure Firewall in its designated subnet with the required supported size unaddressed.

Azure Firewall Basic for simple network filtering is useful when the goal is to fit eligible smaller workloads when advanced throughput and security features are not required. Here, the required behavior is to place Azure Firewall in its designated subnet with the required supported size.

This choice deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection. It leaves the specific need to place Azure Firewall in its designated subnet with the required supported size unaddressed.

Load Balancer load-balancing rule is useful when the goal is to define a frontend protocol/port and backend pool mapping for distributed connections. Here, the required behavior is to map a selected frontend IP and port to an individual backend VM and port.

This choice controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend. It leaves the specific need to map a selected frontend IP and port to an individual backend VM and port unaddressed.

Internal Load Balancer frontend is useful when the goal is to expose a private VNet IP address for a load-balanced service rather than a public endpoint. Here, the required behavior is to map a selected frontend IP and port to an individual backend VM and port.

Private Endpoint for PaaS private IP access exposes a supported Azure service through a private IP interface in the consumer VNet. The current problem instead requires a control that deploys a supported private endpoint NIC in the correct consumer VNet subnet.

Private Endpoint peered-VNet reachability confirms peering, DNS zone links and security policies for clients in another VNet. The current problem instead requires a control that deploys a supported private endpoint NIC in the correct consumer VNet subnet.

Although Private Endpoint NSG and route policy support applies enabled private endpoint network policies when traffic inspection or subnet filtering is needed, that is not sufficient to deploy a supported private endpoint NIC in the correct consumer VNet subnet in this case.

That approach uses an existing supported RADIUS server for VPN user authentication; it does not replace P2S route distribution to clients for the constraint in this scenario.

P2S gateway SKU and concurrent-user limits is useful when the goal is to size point-to-site connectivity for the expected simultaneous remote clients. Here, the required behavior is to advertise or includes the correct private destination prefixes in remote-user VPN profiles.

Although P2S client address pool planning allocates remote-user tunnel addresses without overlapping VNet and on-premises ranges, that is not sufficient to advertise or includes the correct private destination prefixes in remote-user VPN profiles in this case.

Although Virtual WAN secure hub with Azure Firewall integrates managed central security inspection into a Virtual WAN virtual hub, that is not sufficient to size a managed virtual-hub gateway for required bandwidth and connections in this case.

Virtual WAN site-to-site VPN gateway terminates VPN connections from branches within the managed virtual hub. The current problem instead requires a control that sizes a managed virtual-hub gateway for required bandwidth and connections.

Virtual WAN hub VNet connection is useful when the goal is to attache a workload VNet to a managed virtual hub for connectivity and route propagation. Here, the required behavior is to size a managed virtual-hub gateway for required bandwidth and connections.