Microsoft AZ-700 Bundle

ExpressRoute circuit bandwidth and SKU design is useful when the goal is to select supported capacity, metering and reach based on enterprise traffic needs. Here, the required behavior is to provide dedicated high-capacity direct ports at a supported peering location.

Although ExpressRoute peering and connection diagnostics checks provider provisioning, BGP state and Azure connection health before making changes, that is not sufficient to provide dedicated high-capacity direct ports at a supported peering location in this case.

ExpressRoute private peering provides private routing to VNet private address spaces over an ExpressRoute circuit. The current problem instead requires a control that provides dedicated high-capacity direct ports at a supported peering location.

This choice configures supported backend protocol, port, host-name and session behavior. It leaves the specific need to match incoming protocol, port and optional host name before routing requests unaddressed.

Application Gateway TLS termination terminates client HTTPS on the gateway with the appropriate certificate and listener. The current problem instead requires a control that matches incoming protocol, port and optional host name before routing requests.

Although Application Gateway multi-site routing uses host-based listeners to select application backends for different domain names, that is not sufficient to match incoming protocol, port and optional host name before routing requests in this case.

This alternative provides centrally proxied DNS resolution for supported FQDN-based network policy, which solves a different networking task. It does not directly apply FQDN- or application-aware outbound access controls for supported protocols.

Azure Firewall policy rule collection priority organizes matching firewall rules with correct ordering and actions. The current problem instead requires a control that applies FQDN- or application-aware outbound access controls for supported protocols.

This alternative provides managed stateful network and application filtering without Premium-only inspection, which solves a different networking task. It does not directly apply FQDN- or application-aware outbound access controls for supported protocols.

Although Cross-region Azure Load Balancer design uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency, that is not sufficient to use the current supported load balancer SKU with configurable health and security behavior in this case.

Gateway Load Balancer for transparent NVA insertion inserts a supported third-party network virtual appliance fleet transparently into traffic paths. The current problem instead requires a control that uses the current supported load balancer SKU with configurable health and security behavior.

Load Balancer HA ports is useful when the goal is to enable a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. Here, the required behavior is to use the current supported load balancer SKU with configurable health and security behavior.

Although Application Gateway backend pool defines application servers, scale sets or FQDN destinations receiving proxied requests, that is not sufficient to re-encrypt or retains HTTPS between the gateway and validated backend endpoints in this case.

That approach terminates client HTTPS on the gateway with the appropriate certificate and listener; it does not replace Application Gateway end-to-end TLS for the constraint in this scenario.

This choice provides managed regional Layer 7 routing, TLS termination and web traffic distribution. It leaves the specific need to re-encrypt or retains HTTPS between the gateway and validated backend endpoints unaddressed.

Although VNet peering for private backbone connectivity connects two Azure virtual networks over the Microsoft backbone without a VPN appliance, that is not sufficient to let an eligible peered spoke use a hub's VPN or ExpressRoute gateway in this case.

Allow forwarded traffic on VNet peering permits forwarded packets between peered VNets through a hub appliance where appropriate. The current problem instead requires a control that lets an eligible peered spoke use a hub's VPN or ExpressRoute gateway.

That approach applies a NAT Gateway's outbound SNAT behavior to a selected subnet; it does not replace Gateway transit on hub peering for the constraint in this scenario.

Azure Firewall application rule applies FQDN- or application-aware outbound access controls for supported protocols. The current problem instead requires a control that organizes matching firewall rules with correct ordering and actions.

Azure Firewall DNAT rule translates an approved public destination address and port to a protected internal service. The current problem instead requires a control that organizes matching firewall rules with correct ordering and actions.

This alternative centralizes managed firewall settings and reusable rule collections, which solves a different networking task. It does not directly organize matching firewall rules with correct ordering and actions.

Although Service endpoint diagnostic separation checks source subnet configuration, resource firewall rules and actual service reachability, that is not sufficient to restrict supported endpoint traffic from a subnet to specifically allowed Azure Storage resources in this case.

This alternative associates an approved service endpoint policy with the intended endpoint-enabled workload subnet, which solves a different networking task. It does not directly restrict supported endpoint traffic from a subnet to specifically allowed Azure Storage resources.

VNet service endpoint enablement is useful when the goal is to extend selected Azure service routing and service identity from an approved VNet subnet. Here, the required behavior is to restrict supported endpoint traffic from a subnet to specifically allowed Azure Storage resources.

That approach permits forwarded packets between peered VNets through a hub appliance where appropriate; it does not replace VNet peering for private backbone connectivity for the constraint in this scenario.

This choice centrally coordinates VNet connectivity topology across many subscriptions. It leaves the specific need to connect two Azure virtual networks over the Microsoft backbone without a VPN appliance unaddressed.

Although VNet address-space peering sync updates peering awareness after VNet address-space changes, that is not sufficient to connect two Azure virtual networks over the Microsoft backbone without a VPN appliance in this case.

Although Private Endpoint resource-specific authorization scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions, that is not sufficient to require the service owner to authorize pending private endpoint connections when necessary in this case.

Private Endpoint from on-premises via hybrid route is useful when the goal is to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. Here, the required behavior is to require the service owner to authorize pending private endpoint connections when necessary.

This choice targets the correct service resource and subresource in a private endpoint connection. It leaves the specific need to require the service owner to authorize pending private endpoint connections when necessary unaddressed.

That approach provisions the Azure-managed VPN gateway attached to the target VNet; it does not replace VPN gateway SKU throughput planning for the constraint in this scenario.

Route-based site-to-site VPN gateway is useful when the goal is to support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device. Here, the required behavior is to select a supported VPN gateway tier sized for aggregate tunnels and traffic.

Although Active-active VPN gateway design uses multiple gateway instances and connections for supported VPN link resiliency, that is not sufficient to select a supported VPN gateway tier sized for aggregate tunnels and traffic in this case.