Microsoft AZ-700 Bundle

That approach provisions the Azure-managed VPN gateway attached to the target VNet; it does not replace VPN gateway SKU throughput planning for the constraint in this scenario.

Route-based site-to-site VPN gateway is useful when the goal is to support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device. Here, the required behavior is to select a supported VPN gateway tier sized for aggregate tunnels and traffic.

Although Active-active VPN gateway design uses multiple gateway instances and connections for supported VPN link resiliency, that is not sufficient to select a supported VPN gateway tier sized for aggregate tunnels and traffic in this case.

This choice re-encrypts or retains HTTPS between the gateway and validated backend endpoints. It leaves the specific need to define application servers, scale sets or FQDN destinations receiving proxied requests unaddressed.

This choice configures supported backend protocol, port, host-name and session behavior. It leaves the specific need to define application servers, scale sets or FQDN destinations receiving proxied requests unaddressed.

That approach matches incoming protocol, port and optional host name before routing requests; it does not replace Application Gateway backend pool for the constraint in this scenario.

Network Watcher next hop determines a VM's effective route and next-hop category to a destination. The current problem instead requires a control that tests end-to-end reachability, latency and network obstacles between source and destination.

Although Network Watcher connection monitor continuously tracks network reachability and performance between configured endpoints, that is not sufficient to test end-to-end reachability, latency and network obstacles between source and destination in this case.

Network Watcher packet capture is useful when the goal is to capture scoped packet evidence from a supported VM for protocol troubleshooting. Here, the required behavior is to test end-to-end reachability, latency and network obstacles between source and destination.

Virtual WAN site-to-site VPN gateway terminates VPN connections from branches within the managed virtual hub. The current problem instead requires a control that sizes a managed virtual-hub gateway for required bandwidth and connections.

That approach deploys a supported third-party network virtual appliance in the managed hub solution; it does not replace Virtual WAN gateway scale-unit planning for the constraint in this scenario.

That approach deploys a Microsoft-managed regional hub for connectivity, routing and gateway services; it does not replace Virtual WAN gateway scale-unit planning for the constraint in this scenario.

VNet flow log collection is useful when the goal is to capture supported virtual network flow data for operational and security analysis. Here, the required behavior is to govern supported high-priority security admin rules across centrally managed VNets.

NSG network interface association applies additional instance-specific NSG rules to a selected network interface. The current problem instead requires a control that governs supported high-priority security admin rules across centrally managed VNets.

Although ASG-based NSG access rule references application security groups as source or destination in supported NSG rules, that is not sufficient to govern supported high-priority security admin rules across centrally managed VNets in this case.

Application Gateway HTTP settings is useful when the goal is to configure supported backend protocol, port, host-name and session behavior. Here, the required behavior is to modify a supported request or response header or URL before upstream routing.

Application Gateway path-based routing rule is useful when the goal is to select different backends based on URL path patterns. Here, the required behavior is to modify a supported request or response header or URL before upstream routing.

Although Application Gateway custom health probe checks an application-specific path and expected response before including backends, that is not sufficient to modify a supported request or response header or URL before upstream routing in this case.

This choice provides scalable managed outbound connectivity for private subnet workloads. It leaves the specific need to apply a NAT Gateway's outbound SNAT behavior to a selected subnet unaddressed.

Route table association to subnet is useful when the goal is to apply a defined user route collection to the workload subnet. Here, the required behavior is to apply a NAT Gateway's outbound SNAT behavior to a selected subnet.

Gateway transit on hub peering lets an eligible peered spoke use a hub's VPN or ExpressRoute gateway. The current problem instead requires a control that applies a NAT Gateway's outbound SNAT behavior to a selected subnet.

That approach reserves a managed contiguous block of standard public addresses for public IP resources; it does not replace NIC-level public IP association for the constraint in this scenario.

This alternative assigns an intended stable private address to a VM network interface within its subnet, which solves a different networking task. It does not directly attache the public IP to the correct network interface IP configuration.

Public IP SKU and zone suitability is useful when the goal is to select the supported public IP SKU and zone behavior for the intended resource and region. Here, the required behavior is to attache the public IP to the correct network interface IP configuration.

Although Front Door route and origin mapping connects the matching frontend domain/path to the intended origin group, that is not sufficient to protect client-to-edge and edge-to-origin traffic with compatible HTTPS settings in this case.

This alternative checks origin availability from the edge to exclude unhealthy backends, which solves a different networking task. It does not directly protect client-to-edge and edge-to-origin traffic with compatible HTTPS settings.

Although Front Door WAF policy association applies supported application-layer rules at the globally distributed edge, that is not sufficient to protect client-to-edge and edge-to-origin traffic with compatible HTTPS settings in this case.

Front Door WAF policy association applies supported application-layer rules at the globally distributed edge. The current problem instead requires a control that changes the upstream URL path while the client's visible URL remains stable.

Although Front Door end-to-end TLS protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings, that is not sufficient to change the upstream URL path while the client's visible URL remains stable in this case.

This alternative returns an HTTP redirect to the client for an approved URL transformation, which solves a different networking task. It does not directly change the upstream URL path while the client's visible URL remains stable.

Although Private Endpoint for PaaS private IP access exposes a supported Azure service through a private IP interface in the consumer VNet, that is not sufficient to deploy a supported private endpoint NIC in the correct consumer VNet subnet in this case.

Private DNS zone group on private endpoint integrates an endpoint with the appropriate private DNS zone records where supported. The current problem instead requires a control that deploys a supported private endpoint NIC in the correct consumer VNet subnet.

That approach applies enabled private endpoint network policies when traffic inspection or subnet filtering is needed; it does not replace Private Endpoint subnet placement for the constraint in this scenario.