Microsoft AZ-700 Bundle

Virtual network gateway deployment is useful when the goal is to provision the Azure-managed VPN gateway attached to the target VNet. Here, the required behavior is to select a supported VPN gateway tier sized for aggregate tunnels and traffic.

This alternative places a supported VPN gateway across availability zones for regional resilience, which solves a different networking task. It does not directly select a supported VPN gateway tier sized for aggregate tunnels and traffic.

BGP route advertisement on VPN exchanges dynamic network prefixes over a supported route-based VPN configuration. The current problem instead requires a control that selects a supported VPN gateway tier sized for aggregate tunnels and traffic.

Application Gateway HTTP settings is useful when the goal is to configure supported backend protocol, port, host-name and session behavior. Here, the required behavior is to define application servers, scale sets or FQDN destinations receiving proxied requests.

This choice checks an application-specific path and expected response before including backends. It leaves the specific need to define application servers, scale sets or FQDN destinations receiving proxied requests unaddressed.

Although Application Gateway HTTP listener matches incoming protocol, port and optional host name before routing requests, that is not sufficient to define application servers, scale sets or FQDN destinations receiving proxied requests in this case.

This alternative allows an approved cross-subscription connection to an ExpressRoute circuit, which solves a different networking task. It does not directly create the provider-backed private connectivity circuit before linking Azure VNets.

This choice checks provider provisioning, BGP state and Azure connection health before making changes. It leaves the specific need to create the provider-backed private connectivity circuit before linking Azure VNets unaddressed.

ExpressRoute encryption over private connectivity adds a supported encryption overlay when private circuit transport alone is insufficient. The current problem instead requires a control that creates the provider-backed private connectivity circuit before linking Azure VNets.

Although NSG subnet association applies a network security group to all eligible network interfaces in a selected subnet, that is not sufficient to restrict traffic entering a NIC or subnet by source, destination and service port in this case.

This choice references application security groups as source or destination in supported NSG rules. It leaves the specific need to restrict traffic entering a NIC or subnet by source, destination and service port unaddressed.

This alternative tests a specified source/destination/port and reports the allowing or blocking NSG rule, which solves a different networking task. It does not directly restrict traffic entering a NIC or subnet by source, destination and service port.

This choice exposes a supported Azure service through a private IP interface in the consumer VNet. It leaves the specific need to disable or limits public service exposure separately from creating the private endpoint unaddressed.

Private Endpoint approval workflow is useful when the goal is to require the service owner to authorize pending private endpoint connections when necessary. Here, the required behavior is to disable or limits public service exposure separately from creating the private endpoint.

This alternative uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint, which solves a different networking task. It does not directly disable or limits public service exposure separately from creating the private endpoint.

That approach correlates WAF rule IDs, policy actions and client requests to investigate web filtering; it does not replace WAF detection mode for tuning for the constraint in this scenario.

This choice inspects web traffic at Microsoft's global edge before it reaches regional origins. It leaves the specific need to log matching malicious patterns without blocking legitimate traffic during a controlled baseline unaddressed.

WAF prevention mode for active blocking blocks HTTP requests that match configured WAF enforcement rules. The current problem instead requires a control that logs matching malicious patterns without blocking legitimate traffic during a controlled baseline.

This choice applies FQDN- or application-aware outbound access controls for supported protocols. It leaves the specific need to provide managed stateful network and application filtering without Premium-only inspection unaddressed.

Azure Firewall Premium for TLS inspection is useful when the goal is to use the Premium tier's supported TLS inspection and advanced threat features. Here, the required behavior is to provide managed stateful network and application filtering without Premium-only inspection.

That approach provides centrally proxied DNS resolution for supported FQDN-based network policy; it does not replace Azure Firewall Standard for stateful filtering for the constraint in this scenario.

This alternative checks provider provisioning, BGP state and Azure connection health before making changes, which solves a different networking task. It does not directly exchange approved on-premises routes over correct BGP peer sessions.

Although ExpressRoute Global Reach connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity, that is not sufficient to exchange approved on-premises routes over correct BGP peer sessions in this case.

This choice allows an approved cross-subscription connection to an ExpressRoute circuit. It leaves the specific need to exchange approved on-premises routes over correct BGP peer sessions unaddressed.

Adding another Private Endpoint does not fix the client’s use of a raw IP when the current endpoint and DNS record already work.

Service-instance approval is not the problem; the client reaches the correct private IP but uses a hostname that cannot match the TLS certificate.

The Private Endpoint A record is already correct, so changing DNS alone will not fix an application explicitly connecting to an IP literal.

This choice binds the WAF policy to the supported application gateway listener or edge domain. It leaves the specific need to correlate WAF rule IDs, policy actions and client requests to investigate web filtering unaddressed.

Although WAF prevention mode for active blocking blocks HTTP requests that match configured WAF enforcement rules, that is not sufficient to correlate WAF rule IDs, policy actions and client requests to investigate web filtering in this case.

This choice uses a supported managed web attack signature rule set for common application threats. It leaves the specific need to correlate WAF rule IDs, policy actions and client requests to investigate web filtering unaddressed.

Route table association to subnet is useful when the goal is to apply a defined user route collection to the workload subnet. Here, the required behavior is to direct selected subnet traffic to a nominated next-hop NVA address.

This alternative updates peering awareness after VNet address-space changes, which solves a different networking task. It does not directly direct selected subnet traffic to a nominated next-hop NVA address.

NAT Gateway subnet association is useful when the goal is to apply a NAT Gateway's outbound SNAT behavior to a selected subnet. Here, the required behavior is to direct selected subnet traffic to a nominated next-hop NVA address.