Microsoft AZ-700 Bundle

Application Gateway HTTP listener is useful when the goal is to match incoming protocol, port and optional host name before routing requests. Here, the required behavior is to terminate client HTTPS on the gateway with the appropriate certificate and listener.

That approach re-encrypts or retains HTTPS between the gateway and validated backend endpoints; it does not replace Application Gateway TLS termination for the constraint in this scenario.

Application Gateway autoscale adjusts supported v2 gateway capacity automatically to demand within configured boundaries. The current problem instead requires a control that terminates client HTTPS on the gateway with the appropriate certificate and listener.

Azure Virtual Network Manager security admin rules is useful when the goal is to centrally enforce supported security policies across network groups before workload NSGs. Here, the required behavior is to connect two Azure virtual networks over the Microsoft backbone without a VPN appliance.

That approach permits forwarded packets between peered VNets through a hub appliance where appropriate; it does not replace VNet peering for private backbone connectivity for the constraint in this scenario.

That approach centrally coordinates VNet connectivity topology across many subscriptions; it does not replace VNet peering for private backbone connectivity for the constraint in this scenario.

That approach creates the provider-backed private connectivity circuit before linking Azure VNets; it does not replace ExpressRoute circuit authorization for the constraint in this scenario.

ExpressRoute gateway on VNet connects a VNet to an ExpressRoute circuit through the managed gateway. The current problem instead requires a control that allows an approved cross-subscription connection to an ExpressRoute circuit.

ExpressRoute peering and connection diagnostics is useful when the goal is to check provider provisioning, BGP state and Azure connection health before making changes. Here, the required behavior is to allow an approved cross-subscription connection to an ExpressRoute circuit.

That approach aligns corporate firewall route, access and selector rules with Azure connection design; it does not replace Policy-based traffic-selector compatibility for the constraint in this scenario.

This choice supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device. It leaves the specific need to handle a restricted legacy VPN peer that relies on specific address selectors unaddressed.

This choice selects a supported VPN gateway tier sized for aggregate tunnels and traffic. It leaves the specific need to handle a restricted legacy VPN peer that relies on specific address selectors unaddressed.

Managed WAF rule set selection uses a supported managed web attack signature rule set for common application threats. The current problem instead requires a control that inspects HTTP/S requests at a regional application gateway using supported WAF policies.

This choice binds the WAF policy to the supported application gateway listener or edge domain. It leaves the specific need to inspect HTTP/S requests at a regional application gateway using supported WAF policies unaddressed.

Although WAF prevention mode for active blocking blocks HTTP requests that match configured WAF enforcement rules, that is not sufficient to inspect HTTP/S requests at a regional application gateway using supported WAF policies in this case.

Although ExpressRoute Global Reach connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity, that is not sufficient to validate routing and application failover across configured independent ExpressRoute paths in this case.

That approach provides private routing to VNet private address spaces over an ExpressRoute circuit; it does not replace ExpressRoute provider failover testing for the constraint in this scenario.

This choice uses supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone. It leaves the specific need to validate routing and application failover across configured independent ExpressRoute paths unaddressed.

This choice provides dedicated high-capacity direct ports at a supported peering location. It leaves the specific need to use supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone unaddressed.

This alternative provides private routing to VNet private address spaces over an ExpressRoute circuit, which solves a different networking task. It does not directly use supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone.

ExpressRoute redundancy planning uses redundant circuits or locations as required to survive equipment and site failures. The current problem instead requires a control that uses supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone.

Front Door caching configuration is useful when the goal is to cache eligible static web responses at the global edge under explicit policy. Here, the required behavior is to apply supported application-layer rules at the globally distributed edge.

Front Door Rules Engine rewrite is useful when the goal is to change the upstream URL path while the client's visible URL remains stable. Here, the required behavior is to apply supported application-layer rules at the globally distributed edge.

Although Azure Front Door global application delivery provides globally distributed edge entry points with accelerated HTTP/S routing to origins, that is not sufficient to apply supported application-layer rules at the globally distributed edge in this case.

Subnet delegation for PaaS integration delegates a subnet to a supported service so the platform can manage its integration requirements. The current problem instead requires a control that keeps dedicated platform subnets separate from shared workload subnets.

Although Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet, that is not sufficient to keep dedicated platform subnets separate from shared workload subnets in this case.

Subnet network policy placement is useful when the goal is to place security and routing policies on the workload subnet rather than assuming a public IP defines security. Here, the required behavior is to keep dedicated platform subnets separate from shared workload subnets.

NAT Gateway subnet association is useful when the goal is to apply a NAT Gateway's outbound SNAT behavior to a selected subnet. Here, the required behavior is to apply a defined user route collection to the workload subnet.

This alternative directs selected subnet traffic to a nominated next-hop NVA address, which solves a different networking task. It does not directly apply a defined user route collection to the workload subnet.

That approach exchanges dynamic routes with supported network virtual appliances over BGP; it does not replace Route table association to subnet for the constraint in this scenario.

Although Azure Virtual Network Manager security admin rules centrally enforces supported security policies across network groups before workload NSGs, that is not sufficient to exchange dynamic routes with supported network virtual appliances over BGP in this case.

User-defined route to virtual appliance is useful when the goal is to direct selected subnet traffic to a nominated next-hop NVA address. Here, the required behavior is to exchange dynamic routes with supported network virtual appliances over BGP.

This choice reveals which system, BGP or user route determines an actual VM next hop. It leaves the specific need to exchange dynamic routes with supported network virtual appliances over BGP unaddressed.