Microsoft AZ-700 Bundle

IP configuration for multiple VM addresses uses multiple supported IP configurations on a network interface for distinct service addresses. The current problem instead requires a control that keeps dedicated platform subnets separate from shared workload subnets.

Although Dedicated AzureBastionSubnet reserves the specifically named subnet required for Azure Bastion, that is not sufficient to keep dedicated platform subnets separate from shared workload subnets in this case.

That approach delegates a subnet to a supported service so the platform can manage its integration requirements; it does not replace Service-specific subnet isolation for the constraint in this scenario.

This alternative places Azure Firewall in its designated subnet with the required supported size, which solves a different networking task. It does not directly use the Premium tier's supported TLS inspection and advanced threat features.

Firewall logs and threat intelligence monitoring is useful when the goal is to use firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic. Here, the required behavior is to use the Premium tier's supported TLS inspection and advanced threat features.

This alternative provides managed stateful network and application filtering without Premium-only inspection, which solves a different networking task. It does not directly use the Premium tier's supported TLS inspection and advanced threat features.

This choice references application security groups as source or destination in supported NSG rules. It leaves the specific need to provide managed remote VM access without exposing RDP or SSH public IPs on each VM unaddressed.

That approach limits administrative connections to approved sources and ports rather than Internet-wide access; it does not replace Azure Bastion for browser-based VM administration for the constraint in this scenario.

Although Application Security Group membership groups VM interfaces by application role for NSG rule targeting, that is not sufficient to provide managed remote VM access without exposing RDP or SSH public IPs on each VM in this case.

This alternative assigns supported public IP or public IP prefix resources to the gateway, which solves a different networking task. It does not directly apply a NAT Gateway's outbound SNAT behavior to a selected subnet.

Although NAT Gateway for predictable outbound SNAT provides scalable managed outbound connectivity for private subnet workloads, that is not sufficient to apply a NAT Gateway's outbound SNAT behavior to a selected subnet in this case.

Although User-defined route to virtual appliance directs selected subnet traffic to a nominated next-hop NVA address, that is not sufficient to apply a NAT Gateway's outbound SNAT behavior to a selected subnet in this case.

That approach requires the service owner to authorize pending private endpoint connections when necessary; it does not replace Private Endpoint NSG and route policy support for the constraint in this scenario.

That approach deploys a supported private endpoint NIC in the correct consumer VNet subnet; it does not replace Private Endpoint NSG and route policy support for the constraint in this scenario.

That approach uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint; it does not replace Private Endpoint NSG and route policy support for the constraint in this scenario.

That approach sizes point-to-site connectivity for the expected simultaneous remote clients; it does not replace P2S root certificate trust configuration for the constraint in this scenario.

This alternative authenticates supported VPN clients using the organization's Entra identity platform, which solves a different networking task. It does not directly validate certificate-authenticated VPN clients against an uploaded trusted root.

That approach validates supported OS, client version, tunnel profile and endpoint requirements; it does not replace P2S root certificate trust configuration for the constraint in this scenario.

Managed WAF rule set selection is useful when the goal is to use a supported managed web attack signature rule set for common application threats. Here, the required behavior is to inspect HTTP/S requests at a regional application gateway using supported WAF policies.

Although WAF on Azure Front Door for global edge protection inspects web traffic at Microsoft's global edge before it reaches regional origins, that is not sufficient to inspect HTTP/S requests at a regional application gateway using supported WAF policies in this case.

This alternative binds the WAF policy to the supported application gateway listener or edge domain, which solves a different networking task. It does not directly inspect HTTP/S requests at a regional application gateway using supported WAF policies.

This alternative searches security and resource context to find network assets matching risk conditions, which solves a different networking task. It does not directly send supported network resource logs to a workspace for query and retention.

This choice collects performance and health signals for Azure networking resources. It leaves the specific need to send supported network resource logs to a workspace for query and retention unaddressed.

This alternative lists the combined network security rules effective on an Azure VM interface, which solves a different networking task. It does not directly send supported network resource logs to a workspace for query and retention.

This alternative sizes a managed virtual-hub gateway for required bandwidth and connections, which solves a different networking task. It does not directly deploy a Microsoft-managed regional hub for connectivity, routing and gateway services.

This choice deploys a supported third-party network virtual appliance in the managed hub solution. It leaves the specific need to deploy a Microsoft-managed regional hub for connectivity, routing and gateway services unaddressed.

Virtual WAN hub VNet connection is useful when the goal is to attache a workload VNet to a managed virtual hub for connectivity and route propagation. Here, the required behavior is to deploy a Microsoft-managed regional hub for connectivity, routing and gateway services.

Private DNS zone VNet link is useful when the goal is to permit a selected VNet's resolver to query records in a private DNS zone. Here, the required behavior is to test authoritative records, zone links and conditional forwarding in the proper order.

This choice hosts authoritative public DNS records under an internet-resolvable zone. It leaves the specific need to test authoritative records, zone links and conditional forwarding in the proper order unaddressed.

Ruleset VNet association is useful when the goal is to link a forwarding ruleset to the VNets that need to use it. Here, the required behavior is to test authoritative records, zone links and conditional forwarding in the proper order.

Front Door WAF policy association applies supported application-layer rules at the globally distributed edge. The current problem instead requires a control that provides globally distributed edge entry points with accelerated HTTP/S routing to origins.

Although Front Door end-to-end TLS protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings, that is not sufficient to provide globally distributed edge entry points with accelerated HTTP/S routing to origins in this case.

Front Door Rules Engine redirect is useful when the goal is to return an HTTP redirect to the client for an approved URL transformation. Here, the required behavior is to provide globally distributed edge entry points with accelerated HTTP/S routing to origins.