Microsoft AZ-700 Bundle

Although NAT Gateway subnet association applies a NAT Gateway's outbound SNAT behavior to a selected subnet, that is not sufficient to let an eligible peered spoke use a hub's VPN or ExpressRoute gateway in this case.

That approach permits forwarded packets between peered VNets through a hub appliance where appropriate; it does not replace Gateway transit on hub peering for the constraint in this scenario.

That approach assigns supported public IP or public IP prefix resources to the gateway; it does not replace Gateway transit on hub peering for the constraint in this scenario.

This alternative updates peering awareness after VNet address-space changes, which solves a different networking task. It does not directly link the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution.

NAT Gateway for predictable outbound SNAT provides scalable managed outbound connectivity for private subnet workloads. The current problem instead requires a control that links the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution.

Allow forwarded traffic on VNet peering permits forwarded packets between peered VNets through a hub appliance where appropriate. The current problem instead requires a control that links the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution.

This choice targets the correct service resource and subresource in a private endpoint connection. It leaves the specific need to disable or limits public service exposure separately from creating the private endpoint unaddressed.

This choice exposes a supported Azure service through a private IP interface in the consumer VNet. It leaves the specific need to disable or limits public service exposure separately from creating the private endpoint unaddressed.

Private Endpoint from on-premises via hybrid route uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. The current problem instead requires a control that disables or limits public service exposure separately from creating the private endpoint.

NSG subnet association applies a network security group to all eligible network interfaces in a selected subnet. The current problem instead requires a control that applies additional instance-specific NSG rules to a selected network interface.

Azure Virtual Network Manager security admin policy governs supported high-priority security admin rules across centrally managed VNets. The current problem instead requires a control that applies additional instance-specific NSG rules to a selected network interface.

Although ASG-based NSG access rule references application security groups as source or destination in supported NSG rules, that is not sufficient to apply additional instance-specific NSG rules to a selected network interface in this case.

This choice translates an approved public destination address and port to a protected internal service. It leaves the specific need to centralize managed firewall settings and reusable rule collections unaddressed.

That approach deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection; it does not replace Azure Firewall Policy across regions for the constraint in this scenario.

This choice organizes matching firewall rules with correct ordering and actions. It leaves the specific need to centralize managed firewall settings and reusable rule collections unaddressed.

ExpressRoute circuit authorization is useful when the goal is to allow an approved cross-subscription connection to an ExpressRoute circuit. Here, the required behavior is to use redundant circuits or locations as required to survive equipment and site failures.

This alternative connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity, which solves a different networking task. It does not directly use redundant circuits or locations as required to survive equipment and site failures.

Although ExpressRoute gateway on VNet connects a VNet to an ExpressRoute circuit through the managed gateway, that is not sufficient to use redundant circuits or locations as required to survive equipment and site failures in this case.

Application Gateway TLS termination is useful when the goal is to terminate client HTTPS on the gateway with the appropriate certificate and listener. Here, the required behavior is to provide managed regional Layer 7 routing, TLS termination and web traffic distribution.

Application Gateway multi-site routing uses host-based listeners to select application backends for different domain names. The current problem instead requires a control that provides managed regional Layer 7 routing, TLS termination and web traffic distribution.

Although Application Gateway URL rewrite rule modifies a supported request or response header or URL before upstream routing, that is not sufficient to provide managed regional Layer 7 routing, TLS termination and web traffic distribution in this case.

This alternative centrally coordinates VNet connectivity topology across many subscriptions, which solves a different networking task. It does not directly centrally enforce supported security policies across network groups before workload NSGs.

That approach applies a defined user route collection to the workload subnet; it does not replace Azure Virtual Network Manager security admin rules for the constraint in this scenario.

VNet peering for private backbone connectivity connects two Azure virtual networks over the Microsoft backbone without a VPN appliance. The current problem instead requires a control that centrally enforces supported security policies across network groups before workload NSGs.

Virtual WAN virtual hub creation deploys a Microsoft-managed regional hub for connectivity, routing and gateway services. The current problem instead requires a control that controls which route table a hub connection uses for its forwarding decisions.

Although Virtual WAN secure hub with Azure Firewall integrates managed central security inspection into a Virtual WAN virtual hub, that is not sufficient to control which route table a hub connection uses for its forwarding decisions in this case.

This alternative attaches a workload VNet to a managed virtual hub for connectivity and route propagation, which solves a different networking task. It does not directly control which route table a hub connection uses for its forwarding decisions.

Front Door Private Link to supported origin connects an eligible Front Door Premium origin privately without exposing it broadly. The current problem instead requires a control that protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings.

This alternative checks origin availability from the edge to exclude unhealthy backends, which solves a different networking task. It does not directly protect client-to-edge and edge-to-origin traffic with compatible HTTPS settings.

This alternative connects the matching frontend domain/path to the intended origin group, which solves a different networking task. It does not directly protect client-to-edge and edge-to-origin traffic with compatible HTTPS settings.

That approach attaches the public IP to the correct network interface IP configuration; it does not replace Subnet network policy placement for the constraint in this scenario.

Public IP Prefix for contiguous outbound allocation is useful when the goal is to reserve a managed contiguous block of standard public addresses for public IP resources. Here, the required behavior is to place security and routing policies on the workload subnet rather than assuming a public IP defines security.

That approach selects the supported public IP SKU and zone behavior for the intended resource and region; it does not replace Subnet network policy placement for the constraint in this scenario.