Microsoft AZ-700 Bundle

Although ExpressRoute private peering provides private routing to VNet private address spaces over an ExpressRoute circuit, that is not sufficient to create the provider-backed private connectivity circuit before linking Azure VNets in this case.

ExpressRoute circuit authorization allows an approved cross-subscription connection to an ExpressRoute circuit. The current problem instead requires a control that creates the provider-backed private connectivity circuit before linking Azure VNets.

ExpressRoute peering and connection diagnostics is useful when the goal is to check provider provisioning, BGP state and Azure connection health before making changes. Here, the required behavior is to create the provider-backed private connectivity circuit before linking Azure VNets.

Azure Firewall Premium for TLS inspection uses the Premium tier's supported TLS inspection and advanced threat features. The current problem instead requires a control that deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection.

That approach manages and monitors multiple cloud firewalls and supported secure hubs centrally; it does not replace Secure Virtual WAN hub with Azure Firewall for the constraint in this scenario.

Azure Firewall Standard for stateful filtering is useful when the goal is to provide managed stateful network and application filtering without Premium-only inspection. Here, the required behavior is to deploy Azure Firewall into a supported Virtual WAN virtual hub for managed inspection.

That approach records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection; it does not replace IPsec/IKE policy interoperability for the constraint in this scenario.

This choice inspects tunnel state, negotiated parameters and gateway logs before changing routes. It leaves the specific need to align matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device unaddressed.

That approach aligns corporate firewall route, access and selector rules with Azure connection design; it does not replace IPsec/IKE policy interoperability for the constraint in this scenario.

This choice matches incoming protocol, port and optional host name before routing requests. It leaves the specific need to configure supported backend protocol, port, host-name and session behavior unaddressed.

This choice uses host-based listeners to select application backends for different domain names. It leaves the specific need to configure supported backend protocol, port, host-name and session behavior unaddressed.

This alternative adjusts supported v2 gateway capacity automatically to demand within configured boundaries, which solves a different networking task. It does not directly configure supported backend protocol, port, host-name and session behavior.

Application Gateway backend pool defines application servers, scale sets or FQDN destinations receiving proxied requests. The current problem instead requires a control that matches incoming protocol, port and optional host name before routing requests.

Although Application Gateway TLS termination terminates client HTTPS on the gateway with the appropriate certificate and listener, that is not sufficient to match incoming protocol, port and optional host name before routing requests in this case.

That approach configures supported backend protocol, port, host-name and session behavior; it does not replace Application Gateway HTTP listener for the constraint in this scenario.

Although Gateway Load Balancer for transparent NVA insertion inserts a supported third-party network virtual appliance fleet transparently into traffic paths, that is not sufficient to select the intended backend network interfaces or IPs that receive distributed traffic in this case.

Load Balancer load-balancing rule defines a frontend protocol/port and backend pool mapping for distributed connections. The current problem instead requires a control that selects the intended backend network interfaces or IPs that receive distributed traffic.

This alternative controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend, which solves a different networking task. It does not directly select the intended backend network interfaces or IPs that receive distributed traffic.

That approach exposes a private VNet IP address for a load-balanced service rather than a public endpoint; it does not replace Load Balancer inbound NAT rule for the constraint in this scenario.

This alternative defines a frontend protocol/port and backend pool mapping for distributed connections, which solves a different networking task. It does not directly map a selected frontend IP and port to an individual backend VM and port.

Although Public Load Balancer frontend provides an Internet-routable Layer 4 frontend for approved external clients, that is not sufficient to map a selected frontend IP and port to an individual backend VM and port in this case.

Virtual WAN secure hub with Azure Firewall is useful when the goal is to integrate managed central security inspection into a Virtual WAN virtual hub. Here, the required behavior is to support site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology.

That approach attaches a workload VNet to a managed virtual hub for connectivity and route propagation; it does not replace Standard Virtual WAN for advanced transit for the constraint in this scenario.

Virtual WAN virtual hub creation deploys a Microsoft-managed regional hub for connectivity, routing and gateway services. The current problem instead requires a control that supports site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology.

Although Private Endpoint subnet placement deploys a supported private endpoint NIC in the correct consumer VNet subnet, that is not sufficient to integrate an endpoint with the appropriate private DNS zone records where supported in this case.

This choice maps the service's normal FQDN to its private endpoint IP address for authorized clients. It leaves the specific need to integrate an endpoint with the appropriate private DNS zone records where supported unaddressed.

That approach confirms peering, DNS zone links and security policies for clients in another VNet; it does not replace Private DNS zone group on private endpoint for the constraint in this scenario.

That approach provides private routing to VNet private address spaces over an ExpressRoute circuit; it does not replace ExpressRoute Direct for the constraint in this scenario.

Although Microsoft peering requirements on ExpressRoute enables approved Microsoft service access over Microsoft peering rather than private VNet routes, that is not sufficient to provide dedicated high-capacity direct ports at a supported peering location in this case.

Although ExpressRoute FastPath improves data path behavior by bypassing the gateway for supported ExpressRoute data traffic, that is not sufficient to provide dedicated high-capacity direct ports at a supported peering location in this case.

Azure Virtual Network Manager security admin rules centrally enforces supported security policies across network groups before workload NSGs. The current problem instead requires a control that assigns supported public IP or public IP prefix resources to the gateway.

Although NAT Gateway for predictable outbound SNAT provides scalable managed outbound connectivity for private subnet workloads, that is not sufficient to assign supported public IP or public IP prefix resources to the gateway in this case.

This alternative applies a NAT Gateway's outbound SNAT behavior to a selected subnet, which solves a different networking task. It does not directly assign supported public IP or public IP prefix resources to the gateway.