Microsoft AZ-700 Bundle

This alternative provides managed stateful network and application filtering without Premium-only inspection, which solves a different networking task. It does not directly deploy Azure Firewall into a supported Virtual WAN virtual hub for managed inspection.

This choice uses the Premium tier's supported TLS inspection and advanced threat features. It leaves the specific need to deploy Azure Firewall into a supported Virtual WAN virtual hub for managed inspection unaddressed.

AzureFirewallSubnet deployment prerequisite places Azure Firewall in its designated subnet with the required supported size. The current problem instead requires a control that deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection.

Gateway transit on hub peering lets an eligible peered spoke use a hub's VPN or ExpressRoute gateway. The current problem instead requires a control that assigns supported public IP or public IP prefix resources to the gateway.

This alternative applies a NAT Gateway's outbound SNAT behavior to a selected subnet, which solves a different networking task. It does not directly assign supported public IP or public IP prefix resources to the gateway.

Azure Route Server for BGP exchange is useful when the goal is to exchange dynamic routes with supported network virtual appliances over BGP. Here, the required behavior is to assign supported public IP or public IP prefix resources to the gateway.

Route-based site-to-site VPN gateway is useful when the goal is to support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device. Here, the required behavior is to select a supported VPN gateway tier sized for aggregate tunnels and traffic.

Although Zone-redundant VPN Gateway places a supported VPN gateway across availability zones for regional resilience, that is not sufficient to select a supported VPN gateway tier sized for aggregate tunnels and traffic in this case.

That approach exchanges dynamic network prefixes over a supported route-based VPN configuration; it does not replace VPN gateway SKU throughput planning for the constraint in this scenario.

This choice exchanges approved on-premises routes over correct BGP peer sessions. It leaves the specific need to check provider provisioning, BGP state and Azure connection health before making changes unaddressed.

This alternative enables approved Microsoft service access over Microsoft peering rather than private VNet routes, which solves a different networking task. It does not directly check provider provisioning, BGP state and Azure connection health before making changes.

This alternative creates the provider-backed private connectivity circuit before linking Azure VNets, which solves a different networking task. It does not directly check provider provisioning, BGP state and Azure connection health before making changes.

Although ExpressRoute BFD for rapid failure detection uses supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone, that is not sufficient to improve data path behavior by bypassing the gateway for supported ExpressRoute data traffic in this case.

This alternative selects supported capacity, metering and reach based on enterprise traffic needs, which solves a different networking task. It does not directly improve data path behavior by bypassing the gateway for supported ExpressRoute data traffic.

This choice connects a VNet to an ExpressRoute circuit through the managed gateway. It leaves the specific need to improve data path behavior by bypassing the gateway for supported ExpressRoute data traffic unaddressed.

This choice aligns corporate firewall route, access and selector rules with Azure connection design. It leaves the specific need to support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device unaddressed.

BGP route advertisement on VPN is useful when the goal is to exchange dynamic network prefixes over a supported route-based VPN configuration. Here, the required behavior is to support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device.

This choice selects a supported VPN gateway tier sized for aggregate tunnels and traffic. It leaves the specific need to support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device unaddressed.

This choice directs VNet-resident clients to selected DNS servers for specialized resolution. It leaves the specific need to permit a selected VNet's resolver to query records in a private DNS zone unaddressed.

Azure DNS Private Resolver outbound endpoint is useful when the goal is to send selected Azure DNS queries toward other DNS servers through managed forwarding. Here, the required behavior is to permit a selected VNet's resolver to query records in a private DNS zone.

That approach registers eligible VM DNS records automatically in a linked private DNS zone; it does not replace Private DNS zone VNet link for the constraint in this scenario.

Service endpoint unsupported-service review is useful when the goal is to verify whether the selected PaaS resource type supports service endpoints before planning access. Here, the required behavior is to extend selected Azure service routing and service identity from an approved VNet subnet.

This choice retains public service endpoint addressing while changing private subnet routing and service firewall identity. It leaves the specific need to extend selected Azure service routing and service identity from an approved VNet subnet unaddressed.

Although Service endpoint policy for storage resource scope restricts supported endpoint traffic from a subnet to specifically allowed Azure Storage resources, that is not sufficient to extend selected Azure service routing and service identity from an approved VNet subnet in this case.

Although ExpressRoute gateway on VNet connects a VNet to an ExpressRoute circuit through the managed gateway, that is not sufficient to use redundant circuits or locations as required to survive equipment and site failures in this case.

That approach connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity; it does not replace ExpressRoute redundancy planning for the constraint in this scenario.

ExpressRoute private peering is useful when the goal is to provide private routing to VNet private address spaces over an ExpressRoute circuit. Here, the required behavior is to use redundant circuits or locations as required to survive equipment and site failures.

This alternative adjusts supported v2 gateway capacity automatically to demand within configured boundaries, which solves a different networking task. It does not directly configure supported backend protocol, port, host-name and session behavior.

This alternative matches incoming protocol, port and optional host name before routing requests, which solves a different networking task. It does not directly configure supported backend protocol, port, host-name and session behavior.

Although Application Gateway URL rewrite rule modifies a supported request or response header or URL before upstream routing, that is not sufficient to configure supported backend protocol, port, host-name and session behavior in this case.

ExpressRoute encryption over private connectivity is useful when the goal is to add a supported encryption overlay when private circuit transport alone is insufficient. Here, the required behavior is to connect on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity.

That approach uses redundant circuits or locations as required to survive equipment and site failures; it does not replace ExpressRoute Global Reach for the constraint in this scenario.

ExpressRoute circuit provisioning creates the provider-backed private connectivity circuit before linking Azure VNets. The current problem instead requires a control that connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity.