Microsoft AZ-700 Bundle

This choice captures supported virtual network flow data for operational and security analysis. It leaves the specific need to apply a network security group to all eligible network interfaces in a selected subnet unaddressed.

Application Security Group membership groups VM interfaces by application role for NSG rule targeting. The current problem instead requires a control that applies a network security group to all eligible network interfaces in a selected subnet.

This choice applies additional instance-specific NSG rules to a selected network interface. It leaves the specific need to apply a network security group to all eligible network interfaces in a selected subnet unaddressed.

Static private NIC IP configuration assigns an intended stable private address to a VM network interface within its subnet. The current problem instead requires a control that ensures private addresses belong to the selected subnet and interface configuration.

Although Public IP Prefix for contiguous outbound allocation reserves a managed contiguous block of standard public addresses for public IP resources, that is not sufficient to ensure private addresses belong to the selected subnet and interface configuration in this case.

This choice uses multiple supported IP configurations on a network interface for distinct service addresses. It leaves the specific need to ensure private addresses belong to the selected subnet and interface configuration unaddressed.

Although IP configuration for multiple VM addresses uses multiple supported IP configurations on a network interface for distinct service addresses, that is not sufficient to delegate a subnet to a supported service so the platform can manage its integration requirements in this case.

Subnet network policy placement is useful when the goal is to place security and routing policies on the workload subnet rather than assuming a public IP defines security. Here, the required behavior is to delegate a subnet to a supported service so the platform can manage its integration requirements.

Although Service-specific subnet isolation keeps dedicated platform subnets separate from shared workload subnets, that is not sufficient to delegate a subnet to a supported service so the platform can manage its integration requirements in this case.

Associating a WAF policy applies request filtering and security rules; it does not return the intended redirect to the browser.

A custom domain binding provides a DNS-validated host and certificate, not an HTTP redirect for the old URL path.

An internal URL rewrite forwards the changed path toward the origin while the browser may retain the original URL, which fails the visible-redirect requirement.

This choice defines application servers, scale sets or FQDN destinations receiving proxied requests. It leaves the specific need to check an application-specific path and expected response before including backends unaddressed.

That approach selects different backends based on URL path patterns; it does not replace Application Gateway custom health probe for the constraint in this scenario.

Application Gateway multi-site routing uses host-based listeners to select application backends for different domain names. The current problem instead requires a control that checks an application-specific path and expected response before including backends.

Private DNS zone group on private endpoint is useful when the goal is to integrate an endpoint with the appropriate private DNS zone records where supported. Here, the required behavior is to map the service's normal FQDN to its private endpoint IP address for authorized clients.

That approach exposes a supported Azure service through a private IP interface in the consumer VNet; it does not replace Private Endpoint DNS A-record integration for the constraint in this scenario.

This alternative uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint, which solves a different networking task. It does not directly map the service's normal FQDN to its private endpoint IP address for authorized clients.

This alternative adds a supported encryption overlay when private circuit transport alone is insufficient, which solves a different networking task. It does not directly provide private routing to VNet private address spaces over an ExpressRoute circuit.

Microsoft peering requirements on ExpressRoute enables approved Microsoft service access over Microsoft peering rather than private VNet routes. The current problem instead requires a control that provides private routing to VNet private address spaces over an ExpressRoute circuit.

ExpressRoute circuit provisioning creates the provider-backed private connectivity circuit before linking Azure VNets. The current problem instead requires a control that provides private routing to VNet private address spaces over an ExpressRoute circuit.

This choice prioritizes cloud security posture findings including exposed network resources. It leaves the specific need to identify exploitable attack paths that connect exposure and privilege to important assets unaddressed.

This alternative searches security and resource context to find network assets matching risk conditions, which solves a different networking task. It does not directly identify exploitable attack paths that connect exposure and privilege to important assets.

That approach tests end-to-end reachability, latency and network obstacles between source and destination; it does not replace Defender for Cloud attack-path analysis for the constraint in this scenario.

ExpressRoute private peering provides private routing to VNet private address spaces over an ExpressRoute circuit. The current problem instead requires a control that enables approved Microsoft service access over Microsoft peering rather than private VNet routes.

That approach provides dedicated high-capacity direct ports at a supported peering location; it does not replace Microsoft peering requirements on ExpressRoute for the constraint in this scenario.

This choice connects a VNet to an ExpressRoute circuit through the managed gateway. It leaves the specific need to enable approved Microsoft service access over Microsoft peering rather than private VNet routes unaddressed.

Defender for Cloud Secure Score recommendations prioritizes cloud security posture findings including exposed network resources. The current problem instead requires a control that collects performance and health signals for Azure networking resources.

Network Watcher connection monitor continuously tracks network reachability and performance between configured endpoints. The current problem instead requires a control that collects performance and health signals for Azure networking resources.

This choice sends supported network resource logs to a workspace for query and retention. It leaves the specific need to collect performance and health signals for Azure networking resources unaddressed.

Private Endpoint migration cutover is useful when the goal is to update endpoint connections, DNS and service firewall settings together during a resource move. Here, the required behavior is to target the correct service resource and subresource in a private endpoint connection.

This alternative inspects connection state and service-side approvals during private-link troubleshooting, which solves a different networking task. It does not directly target the correct service resource and subresource in a private endpoint connection.

This alternative scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions, which solves a different networking task. It does not directly target the correct service resource and subresource in a private endpoint connection.