Microsoft AZ-700 Bundle

Microsoft Entra ID P2S authentication authenticates supported VPN clients using the organization's Entra identity platform. The current problem instead requires a control that checks identity, certificates and local profile logs before changing gateway routes.

P2S client address pool planning is useful when the goal is to allocate remote-user tunnel addresses without overlapping VNet and on-premises ranges. Here, the required behavior is to check identity, certificates and local profile logs before changing gateway routes.

Although P2S VPN client profile generation delivers the correct gateway endpoints, routes and authentication settings to client devices, that is not sufficient to check identity, certificates and local profile logs before changing gateway routes in this case.

This choice applies additional instance-specific NSG rules to a selected network interface. It leaves the specific need to reference application security groups as source or destination in supported NSG rules unaddressed.

Application Security Group membership is useful when the goal is to group VM interfaces by application role for NSG rule targeting. Here, the required behavior is to reference application security groups as source or destination in supported NSG rules.

Although NSG inbound rule source and port restricts traffic entering a NIC or subnet by source, destination and service port, that is not sufficient to reference application security groups as source or destination in supported NSG rules in this case.

A private endpoint, not a virtual network service endpoint, deploys a resource-connected network interface using an address from the VNet.

Virtual network service endpoints operate on Azure network routing and identity; they do not require the customer to establish an IPsec tunnel to the service.

Service endpoints do not automatically revoke other valid resource firewall rules; the Storage account still follows its explicitly authorized network-access configuration.

This choice attaches a workload VNet to a managed virtual hub for connectivity and route propagation. It leaves the specific need to support site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology unaddressed.

This choice integrates managed central security inspection into a Virtual WAN virtual hub. It leaves the specific need to support site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology unaddressed.

Although Virtual WAN site-to-site VPN gateway terminates VPN connections from branches within the managed virtual hub, that is not sufficient to support site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology in this case.

This alternative balances requests among equally prioritized healthy origins using configured weights, which solves a different networking task. It does not directly select healthy primary and secondary origins using configured priority and health.

This alternative checks origin availability from the edge to exclude unhealthy backends, which solves a different networking task. It does not directly select healthy primary and secondary origins using configured priority and health.

Front Door route and origin mapping is useful when the goal is to connect the matching frontend domain/path to the intended origin group. Here, the required behavior is to select healthy primary and secondary origins using configured priority and health.

This alternative aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device, which solves a different networking task. It does not directly support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device.

Although BGP route advertisement on VPN exchanges dynamic network prefixes over a supported route-based VPN configuration, that is not sufficient to support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device in this case.

On-premises VPN device policy matching is useful when the goal is to align corporate firewall route, access and selector rules with Azure connection design. Here, the required behavior is to support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device.

Virtual WAN hub VNet connection attaches a workload VNet to a managed virtual hub for connectivity and route propagation. The current problem instead requires a control that deploys a supported third-party network virtual appliance in the managed hub solution.

Virtual WAN secure hub with Azure Firewall integrates managed central security inspection into a Virtual WAN virtual hub. The current problem instead requires a control that deploys a supported third-party network virtual appliance in the managed hub solution.

That approach deploys a Microsoft-managed regional hub for connectivity, routing and gateway services; it does not replace Virtual WAN third-party NVA integration for the constraint in this scenario.

This alternative uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency, which solves a different networking task. It does not directly distribute TCP or UDP flows to healthy backend instances in an Azure region.

This choice enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. It leaves the specific need to distribute TCP or UDP flows to healthy backend instances in an Azure region unaddressed.

This alternative selects the intended backend network interfaces or IPs that receive distributed traffic, which solves a different networking task. It does not directly distribute TCP or UDP flows to healthy backend instances in an Azure region.

Front Door WAF policy association is useful when the goal is to apply supported application-layer rules at the globally distributed edge. Here, the required behavior is to connect an eligible Front Door Premium origin privately without exposing it broadly.

Although Front Door route and origin mapping connects the matching frontend domain/path to the intended origin group, that is not sufficient to connect an eligible Front Door Premium origin privately without exposing it broadly in this case.

This alternative checks origin availability from the edge to exclude unhealthy backends, which solves a different networking task. It does not directly connect an eligible Front Door Premium origin privately without exposing it broadly.

NSG subnet association applies a network security group to all eligible network interfaces in a selected subnet. The current problem instead requires a control that captures supported virtual network flow data for operational and security analysis.

Azure Virtual Network Manager security admin policy governs supported high-priority security admin rules across centrally managed VNets. The current problem instead requires a control that captures supported virtual network flow data for operational and security analysis.

This alternative ensures a more specific permitted or denied flow is evaluated in the intended priority order, which solves a different networking task. It does not directly capture supported virtual network flow data for operational and security analysis.

Azure diagnostic settings to Log Analytics sends supported network resource logs to a workspace for query and retention. The current problem instead requires a control that collects performance and health signals for Azure networking resources.

Although Network Watcher effective security rules lists the combined network security rules effective on an Azure VM interface, that is not sufficient to collect performance and health signals for Azure networking resources in this case.

This alternative continuously tracks network reachability and performance between configured endpoints, which solves a different networking task. It does not directly collect performance and health signals for Azure networking resources.