Microsoft AZ-700 Bundle

Although Application Gateway HTTP settings configures supported backend protocol, port, host-name and session behavior, that is not sufficient to re-encrypt or retains HTTPS between the gateway and validated backend endpoints in this case.

Application Gateway TLS termination is useful when the goal is to terminate client HTTPS on the gateway with the appropriate certificate and listener. Here, the required behavior is to re-encrypt or retains HTTPS between the gateway and validated backend endpoints.

Application Gateway for regional HTTP routing is useful when the goal is to provide managed regional Layer 7 routing, TLS termination and web traffic distribution. Here, the required behavior is to re-encrypt or retains HTTPS between the gateway and validated backend endpoints.

P2S route distribution to clients advertises or includes the correct private destination prefixes in remote-user VPN profiles. The current problem instead requires a control that validates certificate-authenticated VPN clients against an uploaded trusted root.

Although Microsoft Entra ID P2S authentication authenticates supported VPN clients using the organization's Entra identity platform, that is not sufficient to validate certificate-authenticated VPN clients against an uploaded trusted root in this case.

VPN client device deployment validation is useful when the goal is to validate supported OS, client version, tunnel profile and endpoint requirements. Here, the required behavior is to validate certificate-authenticated VPN clients against an uploaded trusted root.

This alternative inspects HTTP/S requests at a regional application gateway using supported WAF policies, which solves a different networking task. It does not directly bind the WAF policy to the supported application gateway listener or edge domain.

Although WAF on Azure Front Door for global edge protection inspects web traffic at Microsoft's global edge before it reaches regional origins, that is not sufficient to bind the WAF policy to the supported application gateway listener or edge domain in this case.

Although Custom WAF rule for scoped conditions matches an application-specific condition such as an approved IP, header or path and applies policy, that is not sufficient to bind the WAF policy to the supported application gateway listener or edge domain in this case.

Although Azure Virtual Network Manager security admin rules centrally enforces supported security policies across network groups before workload NSGs, that is not sufficient to connect two Azure virtual networks over the Microsoft backbone without a VPN appliance in this case.

Private DNS zone access for peered VNets is useful when the goal is to link the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution. Here, the required behavior is to connect two Azure virtual networks over the Microsoft backbone without a VPN appliance.

Azure Virtual Network Manager connectivity groups centrally coordinates VNet connectivity topology across many subscriptions. The current problem instead requires a control that connects two Azure virtual networks over the Microsoft backbone without a VPN appliance.

This choice uses endpoint status probes to determine which DNS endpoints remain eligible. It leaves the specific need to choose between geographically distributed public endpoints through DNS responses unaddressed.

Although Regional Azure Load Balancer for L4 traffic distributes TCP or UDP flows to healthy backend instances in an Azure region, that is not sufficient to choose between geographically distributed public endpoints through DNS responses in this case.

Although Public Load Balancer frontend provides an Internet-routable Layer 4 frontend for approved external clients, that is not sufficient to choose between geographically distributed public endpoints through DNS responses in this case.

Azure Firewall application rule is useful when the goal is to apply FQDN- or application-aware outbound access controls for supported protocols. Here, the required behavior is to permit or denies supported IP-based TCP or UDP flows by addresses and ports.

This choice provides centrally proxied DNS resolution for supported FQDN-based network policy. It leaves the specific need to permit or denies supported IP-based TCP or UDP flows by addresses and ports unaddressed.

Although Azure Firewall Basic for simple network filtering fits eligible smaller workloads when advanced throughput and security features are not required, that is not sufficient to permit or denies supported IP-based TCP or UDP flows by addresses and ports in this case.

Although IP flow verify for NSG traffic decision tests a specified source/destination/port and reports the allowing or blocking NSG rule, that is not sufficient to ensure a more specific permitted or denied flow is evaluated in the intended priority order in this case.

That approach groups VM interfaces by application role for NSG rule targeting; it does not replace NSG rule priority and first-match evaluation for the constraint in this scenario.

That approach captures supported virtual network flow data for operational and security analysis; it does not replace NSG rule priority and first-match evaluation for the constraint in this scenario.

This alternative uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency, which solves a different networking task. It does not directly use the current supported load balancer SKU with configurable health and security behavior.

This choice enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. It leaves the specific need to use the current supported load balancer SKU with configurable health and security behavior unaddressed.

Load Balancer health probe is useful when the goal is to test a configured probe endpoint or port to determine eligible healthy backends. Here, the required behavior is to use the current supported load balancer SKU with configurable health and security behavior.

Although Azure Firewall policy rule collection priority organizes matching firewall rules with correct ordering and actions, that is not sufficient to centralize managed firewall settings and reusable rule collections in this case.

This choice deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection. It leaves the specific need to centralize managed firewall settings and reusable rule collections unaddressed.

That approach provides centrally proxied DNS resolution for supported FQDN-based network policy; it does not replace Azure Firewall Policy across regions for the constraint in this scenario.

Although NSG network interface association applies additional instance-specific NSG rules to a selected network interface, that is not sufficient to apply a network security group to all eligible network interfaces in a selected subnet in this case.

That approach groups VM interfaces by application role for NSG rule targeting; it does not replace NSG subnet association for the constraint in this scenario.

Azure Virtual Network Manager security admin policy is useful when the goal is to govern supported high-priority security admin rules across centrally managed VNets. Here, the required behavior is to apply a network security group to all eligible network interfaces in a selected subnet.

This alternative exposes a supported Azure service through a private IP interface in the consumer VNet, which solves a different networking task. It does not directly deploy a supported private endpoint NIC in the correct consumer VNet subnet.

That approach targets the correct service resource and subresource in a private endpoint connection; it does not replace Private Endpoint subnet placement for the constraint in this scenario.

Private Endpoint peered-VNet reachability is useful when the goal is to confirm peering, DNS zone links and security policies for clients in another VNet. Here, the required behavior is to deploy a supported private endpoint NIC in the correct consumer VNet subnet.