Microsoft AZ-700 Bundle

This choice uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. It leaves the specific need to disable or limits public service exposure separately from creating the private endpoint unaddressed.

That approach targets the correct service resource and subresource in a private endpoint connection; it does not replace Private Endpoint public access restriction for the constraint in this scenario.

Private Endpoint DNS A-record integration is useful when the goal is to map the service's normal FQDN to its private endpoint IP address for authorized clients. Here, the required behavior is to disable or limits public service exposure separately from creating the private endpoint.

This choice assigns supported public IP or public IP prefix resources to the gateway. It leaves the specific need to centrally enforce supported security policies across network groups before workload NSGs unaddressed.

Azure Route Server for BGP exchange is useful when the goal is to exchange dynamic routes with supported network virtual appliances over BGP. Here, the required behavior is to centrally enforce supported security policies across network groups before workload NSGs.

Although Azure Virtual Network Manager connectivity groups centrally coordinates VNet connectivity topology across many subscriptions, that is not sufficient to centrally enforce supported security policies across network groups before workload NSGs in this case.

That approach assigns a routable public endpoint to a specified Azure resource when direct exposure is justified; it does not replace Public IP SKU and zone suitability for the constraint in this scenario.

That approach reserves a managed contiguous block of standard public addresses for public IP resources; it does not replace Public IP SKU and zone suitability for the constraint in this scenario.

This choice places security and routing policies on the workload subnet rather than assuming a public IP defines security. It leaves the specific need to select the supported public IP SKU and zone behavior for the intended resource and region unaddressed.

This alternative references application security groups as source or destination in supported NSG rules, which solves a different networking task. It does not directly govern supported high-priority security admin rules across centrally managed VNets.

Although NSG subnet association applies a network security group to all eligible network interfaces in a selected subnet, that is not sufficient to govern supported high-priority security admin rules across centrally managed VNets in this case.

Although NSG rule priority and first-match evaluation ensures a more specific permitted or denied flow is evaluated in the intended priority order, that is not sufficient to govern supported high-priority security admin rules across centrally managed VNets in this case.

Front Door Private Link to supported origin connects an eligible Front Door Premium origin privately without exposing it broadly. The current problem instead requires a control that protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings.

This choice applies supported application-layer rules at the globally distributed edge. It leaves the specific need to protect client-to-edge and edge-to-origin traffic with compatible HTTPS settings unaddressed.

Front Door route and origin mapping connects the matching frontend domain/path to the intended origin group. The current problem instead requires a control that protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings.

NAT Gateway subnet association is useful when the goal is to apply a NAT Gateway's outbound SNAT behavior to a selected subnet. Here, the required behavior is to let an eligible peered spoke use a hub's VPN or ExpressRoute gateway.

NAT Gateway for predictable outbound SNAT is useful when the goal is to provide scalable managed outbound connectivity for private subnet workloads. Here, the required behavior is to let an eligible peered spoke use a hub's VPN or ExpressRoute gateway.

This alternative permits forwarded packets between peered VNets through a hub appliance where appropriate, which solves a different networking task. It does not directly let an eligible peered spoke use a hub's VPN or ExpressRoute gateway.

Changing the endpoint subnet without providing inter-VNet connectivity does not solve a disconnected-client network.

DNS already returns the endpoint private IP, and DNS changes cannot transport packets between disconnected VNets.

A second endpoint for the wrong storage account neither meets the selected resource requirement nor fixes VNet B routing.

This alternative improves data path behavior by bypassing the gateway for supported ExpressRoute data traffic, which solves a different networking task. It does not directly use supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone.

ExpressRoute redundancy planning is useful when the goal is to use redundant circuits or locations as required to survive equipment and site failures. Here, the required behavior is to use supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone.

This choice validates routing and application failover across configured independent ExpressRoute paths. It leaves the specific need to use supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone unaddressed.

Service endpoint policy subnet binding is useful when the goal is to associate an approved service endpoint policy with the intended endpoint-enabled workload subnet. Here, the required behavior is to use an approved private endpoint with hybrid DNS and VPN/ExpressRoute reachability when on-premises clients require private PaaS access.

Service endpoint public address distinction is useful when the goal is to retain public service endpoint addressing while changing private subnet routing and service firewall identity. Here, the required behavior is to use an approved private endpoint with hybrid DNS and VPN/ExpressRoute reachability when on-premises clients require private PaaS access.

That approach checks source subnet configuration, resource firewall rules and actual service reachability; it does not replace Private Endpoint for hybrid private-service consumers for the constraint in this scenario.

That approach provides private routing to VNet private address spaces over an ExpressRoute circuit; it does not replace ExpressRoute redundancy planning for the constraint in this scenario.

This choice uses supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone. It leaves the specific need to use redundant circuits or locations as required to survive equipment and site failures unaddressed.

That approach connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity; it does not replace ExpressRoute redundancy planning for the constraint in this scenario.

Azure Monitor network resource metrics collects performance and health signals for Azure networking resources. The current problem instead requires a control that searches security and resource context to find network assets matching risk conditions.

Defender for Cloud attack-path analysis is useful when the goal is to identify exploitable attack paths that connect exposure and privilege to important assets. Here, the required behavior is to searche security and resource context to find network assets matching risk conditions.

Although Network Watcher effective security rules lists the combined network security rules effective on an Azure VM interface, that is not sufficient to searche security and resource context to find network assets matching risk conditions in this case.