Microsoft AZ-700 Bundle

Azure Virtual Network Manager security admin rules centrally enforces supported security policies across network groups before workload NSGs. The current problem instead requires a control that assigns supported public IP or public IP prefix resources to the gateway.

Although NAT Gateway for predictable outbound SNAT provides scalable managed outbound connectivity for private subnet workloads, that is not sufficient to assign supported public IP or public IP prefix resources to the gateway in this case.

This alternative applies a NAT Gateway's outbound SNAT behavior to a selected subnet, which solves a different networking task. It does not directly assign supported public IP or public IP prefix resources to the gateway.

Although User-defined route to virtual appliance directs selected subnet traffic to a nominated next-hop NVA address, that is not sufficient to reveal which system, BGP or user route determines an actual VM next hop in this case.

Azure Route Server for BGP exchange is useful when the goal is to exchange dynamic routes with supported network virtual appliances over BGP. Here, the required behavior is to reveal which system, BGP or user route determines an actual VM next hop.

Forced-tunnel default route design is useful when the goal is to send Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop. Here, the required behavior is to reveal which system, BGP or user route determines an actual VM next hop.

Azure DNS Private Resolver outbound endpoint is useful when the goal is to send selected Azure DNS queries toward other DNS servers through managed forwarding. Here, the required behavior is to match a domain suffix and forwards queries to designated DNS target servers.

This alternative links a forwarding ruleset to the VNets that need to use it, which solves a different networking task. It does not directly match a domain suffix and forwards queries to designated DNS target servers.

That approach accepts DNS queries arriving from on-premises or connected networks into Azure resolution; it does not replace DNS forwarding ruleset and rules for the constraint in this scenario.

This choice provides an Internet-routable Layer 4 frontend for approved external clients. It leaves the specific need to expose a private VNet IP address for a load-balanced service rather than a public endpoint unaddressed.

Load Balancer load-balancing rule is useful when the goal is to define a frontend protocol/port and backend pool mapping for distributed connections. Here, the required behavior is to expose a private VNet IP address for a load-balanced service rather than a public endpoint.

That approach enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios; it does not replace Internal Load Balancer frontend for the constraint in this scenario.

That approach targets the correct service resource and subresource in a private endpoint connection; it does not replace Private Endpoint NSG and route policy support for the constraint in this scenario.

Private Endpoint subnet placement deploys a supported private endpoint NIC in the correct consumer VNet subnet. The current problem instead requires a control that applies enabled private endpoint network policies when traffic inspection or subnet filtering is needed.

This alternative requires appropriate VPN, ExpressRoute or peering connectivity before remote networks can route to a private endpoint IP, which solves a different networking task. It does not directly apply enabled private endpoint network policies when traffic inspection or subnet filtering is needed.

That approach authenticates supported VPN clients using the organization's Entra identity platform; it does not replace P2S client-side authentication troubleshooting for the constraint in this scenario.

P2S client address pool planning allocates remote-user tunnel addresses without overlapping VNet and on-premises ranges. The current problem instead requires a control that checks identity, certificates and local profile logs before changing gateway routes.

This choice validates supported OS, client version, tunnel profile and endpoint requirements. It leaves the specific need to check identity, certificates and local profile logs before changing gateway routes unaddressed.

That approach configures supported backend protocol, port, host-name and session behavior; it does not replace Application Gateway end-to-end TLS for the constraint in this scenario.

Although Application Gateway custom health probe checks an application-specific path and expected response before including backends, that is not sufficient to re-encrypt or retains HTTPS between the gateway and validated backend endpoints in this case.

This choice terminates client HTTPS on the gateway with the appropriate certificate and listener. It leaves the specific need to re-encrypt or retains HTTPS between the gateway and validated backend endpoints unaddressed.

That approach handles a restricted legacy VPN peer that relies on specific address selectors; it does not replace VPN gateway SKU throughput planning for the constraint in this scenario.

Zone-redundant VPN Gateway places a supported VPN gateway across availability zones for regional resilience. The current problem instead requires a control that selects a supported VPN gateway tier sized for aggregate tunnels and traffic.

This alternative uses multiple gateway instances and connections for supported VPN link resiliency, which solves a different networking task. It does not directly select a supported VPN gateway tier sized for aggregate tunnels and traffic.

This alternative inserts a supported third-party network virtual appliance fleet transparently into traffic paths, which solves a different networking task. It does not directly enable a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios.

Standard Load Balancer for modern workloads uses the current supported load balancer SKU with configurable health and security behavior. The current problem instead requires a control that enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios.

This alternative distributes TCP or UDP flows to healthy backend instances in an Azure region, which solves a different networking task. It does not directly enable a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios.

Custom DNS server settings on VNet is useful when the goal is to direct VNet-resident clients to selected DNS servers for specialized resolution. Here, the required behavior is to send selected Azure DNS queries toward other DNS servers through managed forwarding.

Azure DNS Private Resolver inbound endpoint accepts DNS queries arriving from on-premises or connected networks into Azure resolution. The current problem instead requires a control that sends selected Azure DNS queries toward other DNS servers through managed forwarding.

That approach stores DNS records visible through linked private-network resolution rather than public DNS; it does not replace Azure DNS Private Resolver outbound endpoint for the constraint in this scenario.

Application Gateway HTTP listener is useful when the goal is to match incoming protocol, port and optional host name before routing requests. Here, the required behavior is to terminate client HTTPS on the gateway with the appropriate certificate and listener.

That approach re-encrypts or retains HTTPS between the gateway and validated backend endpoints; it does not replace Application Gateway TLS termination for the constraint in this scenario.

Application Gateway autoscale adjusts supported v2 gateway capacity automatically to demand within configured boundaries. The current problem instead requires a control that terminates client HTTPS on the gateway with the appropriate certificate and listener.