Microsoft AZ-700 Bundle

That approach uses an existing supported RADIUS server for VPN user authentication; it does not replace Microsoft Entra ID P2S authentication for the constraint in this scenario.

Although P2S route distribution to clients advertises or includes the correct private destination prefixes in remote-user VPN profiles, that is not sufficient to authenticate supported VPN clients using the organization's Entra identity platform in this case.

P2S root certificate trust configuration is useful when the goal is to validate certificate-authenticated VPN clients against an uploaded trusted root. Here, the required behavior is to authenticate supported VPN clients using the organization's Entra identity platform.

Load Balancer load-balancing rule defines a frontend protocol/port and backend pool mapping for distributed connections. The current problem instead requires a control that controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend.

Although Standard Load Balancer for modern workloads uses the current supported load balancer SKU with configurable health and security behavior, that is not sufficient to control SNAT for backend VMs that require outbound connectivity using a load-balancer frontend in this case.

That approach provides an Internet-routable Layer 4 frontend for approved external clients; it does not replace Load Balancer outbound rule for the constraint in this scenario.

Application Gateway backend pool is useful when the goal is to define application servers, scale sets or FQDN destinations receiving proxied requests. Here, the required behavior is to match incoming protocol, port and optional host name before routing requests.

Although Application Gateway for regional HTTP routing provides managed regional Layer 7 routing, TLS termination and web traffic distribution, that is not sufficient to match incoming protocol, port and optional host name before routing requests in this case.

Application Gateway HTTP settings configures supported backend protocol, port, host-name and session behavior. The current problem instead requires a control that matches incoming protocol, port and optional host name before routing requests.

This alternative reserves a managed contiguous block of standard public addresses for public IP resources, which solves a different networking task. It does not directly onboard an organization's eligible public IPv4 address block into Azure.

Although Standard Public IP for internet-facing VM assigns a routable public endpoint to a specified Azure resource when direct exposure is justified, that is not sufficient to onboard an organization's eligible public IPv4 address block into Azure in this case.

This choice expands address capacity while managing dependencies and routing effects. It leaves the specific need to onboard an organization's eligible public IPv4 address block into Azure unaddressed.

Although IPsec/IKE policy interoperability aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device, that is not sufficient to inspect tunnel state, negotiated parameters and gateway logs before changing routes in this case.

Although On-premises VPN device policy matching aligns corporate firewall route, access and selector rules with Azure connection design, that is not sufficient to inspect tunnel state, negotiated parameters and gateway logs before changing routes in this case.

Although S2S reachability verification beyond tunnel state validates routing, NSGs and return paths after IPsec reports connected, that is not sufficient to inspect tunnel state, negotiated parameters and gateway logs before changing routes in this case.

This alternative exposes a private VNet IP address for a load-balanced service rather than a public endpoint, which solves a different networking task. It does not directly provide an Internet-routable Layer 4 frontend for approved external clients.

That approach controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend; it does not replace Public Load Balancer frontend for the constraint in this scenario.

Load Balancer inbound NAT rule is useful when the goal is to map a selected frontend IP and port to an individual backend VM and port. Here, the required behavior is to provide an Internet-routable Layer 4 frontend for approved external clients.

Azure-provided DNS for VNet hostnames is useful when the goal is to resolve supported internal hostnames using default Azure DNS within a VNet. Here, the required behavior is to direct VNet-resident clients to selected DNS servers for specialized resolution.

That approach permits a selected VNet's resolver to query records in a private DNS zone; it does not replace Custom DNS server settings on VNet for the constraint in this scenario.

DNS forwarding ruleset and rules matches a domain suffix and forwards queries to designated DNS target servers. The current problem instead requires a control that directs VNet-resident clients to selected DNS servers for specialized resolution.

Network Watcher next hop is useful when the goal is to determine a VM's effective route and next-hop category to a destination. Here, the required behavior is to list the combined network security rules effective on an Azure VM interface.

This alternative continuously tracks network reachability and performance between configured endpoints, which solves a different networking task. It does not directly list the combined network security rules effective on an Azure VM interface.

Cloud Security Explorer asset queries searches security and resource context to find network assets matching risk conditions. The current problem instead requires a control that lists the combined network security rules effective on an Azure VM interface.

Private Link service provider design exposes a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link. The current problem instead requires a control that exposes a supported Azure service through a private IP interface in the consumer VNet.

This choice uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. It leaves the specific need to expose a supported Azure service through a private IP interface in the consumer VNet unaddressed.

Private Endpoint subnet placement deploys a supported private endpoint NIC in the correct consumer VNet subnet. The current problem instead requires a control that exposes a supported Azure service through a private IP interface in the consumer VNet.

That approach deploys a Microsoft-managed regional hub for connectivity, routing and gateway services; it does not replace Virtual WAN hub VNet connection for the constraint in this scenario.

Virtual WAN gateway scale-unit planning sizes a managed virtual-hub gateway for required bandwidth and connections. The current problem instead requires a control that attaches a workload VNet to a managed virtual hub for connectivity and route propagation.

Virtual WAN route propagation and labels is useful when the goal is to define which routes are advertised into selected hub route tables and connection groups. Here, the required behavior is to attache a workload VNet to a managed virtual hub for connectivity and route propagation.

Zone-redundant VPN Gateway is useful when the goal is to place a supported VPN gateway across availability zones for regional resilience. Here, the required behavior is to use multiple gateway instances and connections for supported VPN link resiliency.

VPN gateway SKU throughput planning selects a supported VPN gateway tier sized for aggregate tunnels and traffic. The current problem instead requires a control that uses multiple gateway instances and connections for supported VPN link resiliency.

That approach aligns corporate firewall route, access and selector rules with Azure connection design; it does not replace Active-active VPN gateway design for the constraint in this scenario.