Microsoft AZ-700 Bundle

Azure diagnostic settings to Log Analytics sends supported network resource logs to a workspace for query and retention. The current problem instead requires a control that collects performance and health signals for Azure networking resources.

Although Network Watcher effective security rules lists the combined network security rules effective on an Azure VM interface, that is not sufficient to collect performance and health signals for Azure networking resources in this case.

This alternative continuously tracks network reachability and performance between configured endpoints, which solves a different networking task. It does not directly collect performance and health signals for Azure networking resources.

This alternative gives authorized consumers a service alias to request private endpoints without using the full resource ID, which solves a different networking task. It does not directly inspect connection state and service-side approvals during private-link troubleshooting.

Private Endpoint subresource selection is useful when the goal is to target the correct service resource and subresource in a private endpoint connection. Here, the required behavior is to inspect connection state and service-side approvals during private-link troubleshooting.

This alternative scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions, which solves a different networking task. It does not directly inspect connection state and service-side approvals during private-link troubleshooting.

This choice attaches a workload VNet to a managed virtual hub for connectivity and route propagation. It leaves the specific need to integrate managed central security inspection into a Virtual WAN virtual hub unaddressed.

This choice terminates VPN connections from branches within the managed virtual hub. It leaves the specific need to integrate managed central security inspection into a Virtual WAN virtual hub unaddressed.

This alternative deploys a Microsoft-managed regional hub for connectivity, routing and gateway services, which solves a different networking task. It does not directly integrate managed central security inspection into a Virtual WAN virtual hub.

Front Door Rules Engine redirect is useful when the goal is to return an HTTP redirect to the client for an approved URL transformation. Here, the required behavior is to provide globally distributed edge entry points with accelerated HTTP/S routing to origins.

This choice caches eligible static web responses at the global edge under explicit policy. It leaves the specific need to provide globally distributed edge entry points with accelerated HTTP/S routing to origins unaddressed.

Although Front Door WAF policy association applies supported application-layer rules at the globally distributed edge, that is not sufficient to provide globally distributed edge entry points with accelerated HTTP/S routing to origins in this case.

User-defined route to virtual appliance is useful when the goal is to direct selected subnet traffic to a nominated next-hop NVA address. Here, the required behavior is to check both forward and return routing when traffic crosses a central firewall or appliance.

This choice permits forwarded packets between peered VNets through a hub appliance where appropriate. It leaves the specific need to check both forward and return routing when traffic crosses a central firewall or appliance unaddressed.

Although Forced-tunnel default route design sends Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop, that is not sufficient to check both forward and return routing when traffic crosses a central firewall or appliance in this case.

Front Door origin group priority failover is useful when the goal is to select healthy primary and secondary origins using configured priority and health. Here, the required behavior is to balance requests among equally prioritized healthy origins using configured weights.

That approach checks origin availability from the edge to exclude unhealthy backends; it does not replace Front Door origin weighting for load distribution for the constraint in this scenario.

Front Door Private Link to supported origin connects an eligible Front Door Premium origin privately without exposing it broadly. The current problem instead requires a control that balances requests among equally prioritized healthy origins using configured weights.

This alternative applies a network security group to all eligible network interfaces in a selected subnet, which solves a different networking task. It does not directly govern supported high-priority security admin rules across centrally managed VNets.

ASG-based NSG access rule references application security groups as source or destination in supported NSG rules. The current problem instead requires a control that governs supported high-priority security admin rules across centrally managed VNets.

VNet flow log collection captures supported virtual network flow data for operational and security analysis. The current problem instead requires a control that governs supported high-priority security admin rules across centrally managed VNets.

This choice adjusts supported v2 gateway capacity automatically to demand within configured boundaries. It leaves the specific need to modify a supported request or response header or URL before upstream routing unaddressed.

Application Gateway custom health probe is useful when the goal is to check an application-specific path and expected response before including backends. Here, the required behavior is to modify a supported request or response header or URL before upstream routing.

Application Gateway path-based routing rule is useful when the goal is to select different backends based on URL path patterns. Here, the required behavior is to modify a supported request or response header or URL before upstream routing.

Although Static private NIC IP configuration assigns an intended stable private address to a VM network interface within its subnet, that is not sufficient to use multiple supported IP configurations on a network interface for distinct service addresses in this case.

NIC-level public IP association is useful when the goal is to attache the public IP to the correct network interface IP configuration. Here, the required behavior is to use multiple supported IP configurations on a network interface for distinct service addresses.

Although Private IP allocation consistency across NICs ensures private addresses belong to the selected subnet and interface configuration, that is not sufficient to use multiple supported IP configurations on a network interface for distinct service addresses in this case.

Azure Virtual Network Manager security admin policy governs supported high-priority security admin rules across centrally managed VNets. The current problem instead requires a control that references application security groups as source or destination in supported NSG rules.

Although Application Security Group membership groups VM interfaces by application role for NSG rule targeting, that is not sufficient to reference application security groups as source or destination in supported NSG rules in this case.

NSG inbound rule source and port is useful when the goal is to restrict traffic entering a NIC or subnet by source, destination and service port. Here, the required behavior is to reference application security groups as source or destination in supported NSG rules.

This alternative aligns corporate firewall route, access and selector rules with Azure connection design, which solves a different networking task. It does not directly handle a restricted legacy VPN peer that relies on specific address selectors.

Route-based site-to-site VPN gateway supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device. The current problem instead requires a control that handles a restricted legacy VPN peer that relies on specific address selectors.

S2S peer public IP change procedure updates peer and local network gateway settings together during a branch cutover. The current problem instead requires a control that handles a restricted legacy VPN peer that relies on specific address selectors.