Microsoft AZ-700 Bundle

Application Gateway TLS termination terminates client HTTPS on the gateway with the appropriate certificate and listener. The current problem instead requires a control that adjusts supported v2 gateway capacity automatically to demand within configured boundaries.

Application Gateway end-to-end TLS re-encrypts or retains HTTPS between the gateway and validated backend endpoints. The current problem instead requires a control that adjusts supported v2 gateway capacity automatically to demand within configured boundaries.

Application Gateway HTTP settings configures supported backend protocol, port, host-name and session behavior. The current problem instead requires a control that adjusts supported v2 gateway capacity automatically to demand within configured boundaries.

This alternative selects a supported VPN gateway tier sized for aggregate tunnels and traffic, which solves a different networking task. It does not directly place a supported VPN gateway across availability zones for regional resilience.

This choice exchanges dynamic network prefixes over a supported route-based VPN configuration. It leaves the specific need to place a supported VPN gateway across availability zones for regional resilience unaddressed.

Active-active VPN gateway design uses multiple gateway instances and connections for supported VPN link resiliency. The current problem instead requires a control that places a supported VPN gateway across availability zones for regional resilience.

This choice defines a frontend protocol/port and backend pool mapping for distributed connections. It leaves the specific need to test a configured probe endpoint or port to determine eligible healthy backends unaddressed.

Load Balancer inbound NAT rule is useful when the goal is to map a selected frontend IP and port to an individual backend VM and port. Here, the required behavior is to test a configured probe endpoint or port to determine eligible healthy backends.

This choice uses endpoint status probes to determine which DNS endpoints remain eligible. It leaves the specific need to test a configured probe endpoint or port to determine eligible healthy backends unaddressed.

This alternative captures scoped packet evidence from a supported VM for protocol troubleshooting, which solves a different networking task. It does not directly list the combined network security rules effective on an Azure VM interface.

That approach searches security and resource context to find network assets matching risk conditions; it does not replace Network Watcher effective security rules for the constraint in this scenario.

That approach determines a VM's effective route and next-hop category to a destination; it does not replace Network Watcher effective security rules for the constraint in this scenario.

This choice allows an approved cross-subscription connection to an ExpressRoute circuit. It leaves the specific need to connect a VNet to an ExpressRoute circuit through the managed gateway unaddressed.

Although ExpressRoute private peering provides private routing to VNet private address spaces over an ExpressRoute circuit, that is not sufficient to connect a VNet to an ExpressRoute circuit through the managed gateway in this case.

This choice connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity. It leaves the specific need to connect a VNet to an ExpressRoute circuit through the managed gateway unaddressed.

This alternative delivers the correct gateway endpoints, routes and authentication settings to client devices, which solves a different networking task. It does not directly use an existing supported RADIUS server for VPN user authentication.

P2S route distribution to clients is useful when the goal is to advertise or includes the correct private destination prefixes in remote-user VPN profiles. Here, the required behavior is to use an existing supported RADIUS server for VPN user authentication.

That approach checks identity, certificates and local profile logs before changing gateway routes; it does not replace RADIUS authentication for P2S VPN for the constraint in this scenario.

Although Virtual WAN route propagation and labels defines which routes are advertised into selected hub route tables and connection groups, that is not sufficient to attache a workload VNet to a managed virtual hub for connectivity and route propagation in this case.

Virtual WAN secure hub with Azure Firewall is useful when the goal is to integrate managed central security inspection into a Virtual WAN virtual hub. Here, the required behavior is to attache a workload VNet to a managed virtual hub for connectivity and route propagation.

Virtual WAN hub routing table association is useful when the goal is to control which route table a hub connection uses for its forwarding decisions. Here, the required behavior is to attache a workload VNet to a managed virtual hub for connectivity and route propagation.

Network Watcher effective security rules lists the combined network security rules effective on an Azure VM interface. The current problem instead requires a control that searches security and resource context to find network assets matching risk conditions.

This choice sends supported network resource logs to a workspace for query and retention. It leaves the specific need to searche security and resource context to find network assets matching risk conditions unaddressed.

That approach prioritizes cloud security posture findings including exposed network resources; it does not replace Cloud Security Explorer asset queries for the constraint in this scenario.

This choice terminates client HTTPS on the gateway with the appropriate certificate and listener. It leaves the specific need to provide managed regional Layer 7 routing, TLS termination and web traffic distribution unaddressed.

Although Application Gateway URL rewrite rule modifies a supported request or response header or URL before upstream routing, that is not sufficient to provide managed regional Layer 7 routing, TLS termination and web traffic distribution in this case.

This choice matches incoming protocol, port and optional host name before routing requests. It leaves the specific need to provide managed regional Layer 7 routing, TLS termination and web traffic distribution unaddressed.

That approach centralizes managed firewall settings and reusable rule collections; it does not replace Secure Virtual WAN hub with Azure Firewall for the constraint in this scenario.

That approach uses the Premium tier's supported TLS inspection and advanced threat features; it does not replace Secure Virtual WAN hub with Azure Firewall for the constraint in this scenario.

Although Azure Firewall Standard for stateful filtering provides managed stateful network and application filtering without Premium-only inspection, that is not sufficient to deploy Azure Firewall into a supported Virtual WAN virtual hub for managed inspection in this case.

Although NAT Gateway subnet association applies a NAT Gateway's outbound SNAT behavior to a selected subnet, that is not sufficient to let an eligible peered spoke use a hub's VPN or ExpressRoute gateway in this case.

That approach permits forwarded packets between peered VNets through a hub appliance where appropriate; it does not replace Gateway transit on hub peering for the constraint in this scenario.

That approach assigns supported public IP or public IP prefix resources to the gateway; it does not replace Gateway transit on hub peering for the constraint in this scenario.