Microsoft AZ-700 Bundle

Application Gateway URL rewrite rule is useful when the goal is to modify a supported request or response header or URL before upstream routing. Here, the required behavior is to select different backends based on URL path patterns.

Although Application Gateway multi-site routing uses host-based listeners to select application backends for different domain names, that is not sufficient to select different backends based on URL path patterns in this case.

This alternative provides managed regional Layer 7 routing, TLS termination and web traffic distribution, which solves a different networking task. It does not directly select different backends based on URL path patterns.

This choice determines a VM's effective route and next-hop category to a destination. It leaves the specific need to capture scoped packet evidence from a supported VM for protocol troubleshooting unaddressed.

This choice continuously tracks network reachability and performance between configured endpoints. It leaves the specific need to capture scoped packet evidence from a supported VM for protocol troubleshooting unaddressed.

That approach lists the combined network security rules effective on an Azure VM interface; it does not replace Network Watcher packet capture for the constraint in this scenario.

This choice assigns an intended stable private address to a VM network interface within its subnet. It leaves the specific need to allocate the reserved gateway subnet used by Azure VPN or ExpressRoute gateways unaddressed.

Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet. The current problem instead requires a control that allocates the reserved gateway subnet used by Azure VPN or ExpressRoute gateways.

This choice provides the reserved firewall subnet for the managed Azure Firewall deployment. It leaves the specific need to allocate the reserved gateway subnet used by Azure VPN or ExpressRoute gateways unaddressed.

NSG inbound rule source and port is useful when the goal is to restrict traffic entering a NIC or subnet by source, destination and service port. Here, the required behavior is to apply a network security group to all eligible network interfaces in a selected subnet.

Application Security Group membership is useful when the goal is to group VM interfaces by application role for NSG rule targeting. Here, the required behavior is to apply a network security group to all eligible network interfaces in a selected subnet.

This alternative reads merged effective rules after both subnet and NIC associations, which solves a different networking task. It does not directly apply a network security group to all eligible network interfaces in a selected subnet.

This alternative uses multiple supported IP configurations on a network interface for distinct service addresses, which solves a different networking task. It does not directly delegate a subnet to a supported service so the platform can manage its integration requirements.

Although Address and subnet allocation inventory tracks CIDR ownership, free space and subnet relationships before deployment, that is not sufficient to delegate a subnet to a supported service so the platform can manage its integration requirements in this case.

Service-specific subnet isolation keeps dedicated platform subnets separate from shared workload subnets. The current problem instead requires a control that delegates a subnet to a supported service so the platform can manage its integration requirements.

This choice places a supported VPN gateway across availability zones for regional resilience. It leaves the specific need to use multiple gateway instances and connections for supported VPN link resiliency unaddressed.

Route-based site-to-site VPN gateway is useful when the goal is to support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device. Here, the required behavior is to use multiple gateway instances and connections for supported VPN link resiliency.

Virtual network gateway deployment is useful when the goal is to provision the Azure-managed VPN gateway attached to the target VNet. Here, the required behavior is to use multiple gateway instances and connections for supported VPN link resiliency.

Although WAF false-positive exclusion tuning narrows a proven harmless match while retaining the remainder of managed protections, that is not sufficient to block HTTP requests that match configured WAF enforcement rules in this case.

This alternative inspects HTTP/S requests at a regional application gateway using supported WAF policies, which solves a different networking task. It does not directly block HTTP requests that match configured WAF enforcement rules.

This alternative logs matching malicious patterns without blocking legitimate traffic during a controlled baseline, which solves a different networking task. It does not directly block HTTP requests that match configured WAF enforcement rules.

VPN gateway SKU throughput planning is useful when the goal is to select a supported VPN gateway tier sized for aggregate tunnels and traffic. Here, the required behavior is to exchange dynamic network prefixes over a supported route-based VPN configuration.

That approach supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device; it does not replace BGP route advertisement on VPN for the constraint in this scenario.

Although Local network gateway configuration records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection, that is not sufficient to exchange dynamic network prefixes over a supported route-based VPN configuration in this case.

That approach registers eligible VM DNS records automatically in a linked private DNS zone; it does not replace DNS answer-path troubleshooting for the constraint in this scenario.

This choice links a forwarding ruleset to the VNets that need to use it. It leaves the specific need to test authoritative records, zone links and conditional forwarding in the proper order unaddressed.

Azure DNS public zone delegation hosts authoritative public DNS records under an internet-resolvable zone. The current problem instead requires a control that tests authoritative records, zone links and conditional forwarding in the proper order.

This alternative collects performance and health signals for Azure networking resources, which solves a different networking task. It does not directly add managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses.

That approach lists the combined network security rules effective on an Azure VM interface; it does not replace Azure DDoS Protection deployment for the constraint in this scenario.

Although Network Watcher connection monitor continuously tracks network reachability and performance between configured endpoints, that is not sufficient to add managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses in this case.

Although S2S reachability verification beyond tunnel state validates routing, NSGs and return paths after IPsec reports connected, that is not sufficient to inspect tunnel state, negotiated parameters and gateway logs before changing routes in this case.

IPsec/IKE policy interoperability is useful when the goal is to align matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device. Here, the required behavior is to inspect tunnel state, negotiated parameters and gateway logs before changing routes.

Zone-redundant VPN Gateway is useful when the goal is to place a supported VPN gateway across availability zones for regional resilience. Here, the required behavior is to inspect tunnel state, negotiated parameters and gateway logs before changing routes.