Microsoft AZ-700 Bundle

That approach reserves a managed contiguous block of standard public addresses for public IP resources; it does not replace Private IP allocation consistency across NICs for the constraint in this scenario.

Static private NIC IP configuration is useful when the goal is to assign an intended stable private address to a VM network interface within its subnet. Here, the required behavior is to ensure private addresses belong to the selected subnet and interface configuration.

Although NIC-level public IP association attaches the public IP to the correct network interface IP configuration, that is not sufficient to ensure private addresses belong to the selected subnet and interface configuration in this case.

This alternative configures an approved domain, DNS validation and certificate for the edge endpoint, which solves a different networking task. It does not directly cache eligible static web responses at the global edge under explicit policy.

This choice provides globally distributed edge entry points with accelerated HTTP/S routing to origins. It leaves the specific need to cache eligible static web responses at the global edge under explicit policy unaddressed.

Although Front Door WAF policy association applies supported application-layer rules at the globally distributed edge, that is not sufficient to cache eligible static web responses at the global edge under explicit policy in this case.

Although WAF policy association to listener or domain binds the WAF policy to the supported application gateway listener or edge domain, that is not sufficient to block HTTP requests that match configured WAF enforcement rules in this case.

WAF diagnostic logging and investigation is useful when the goal is to correlate WAF rule IDs, policy actions and client requests to investigate web filtering. Here, the required behavior is to block HTTP requests that match configured WAF enforcement rules.

WAF on Application Gateway for regional web protection inspects HTTP/S requests at a regional application gateway using supported WAF policies. The current problem instead requires a control that blocks HTTP requests that match configured WAF enforcement rules.

Application Gateway TLS termination terminates client HTTPS on the gateway with the appropriate certificate and listener. The current problem instead requires a control that checks an application-specific path and expected response before including backends.

Application Gateway URL rewrite rule is useful when the goal is to modify a supported request or response header or URL before upstream routing. Here, the required behavior is to check an application-specific path and expected response before including backends.

Although Application Gateway path-based routing rule selects different backends based on URL path patterns, that is not sufficient to check an application-specific path and expected response before including backends in this case.

ExpressRoute Global Reach connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity. The current problem instead requires a control that validates routing and application failover across configured independent ExpressRoute paths.

That approach provides private routing to VNet private address spaces over an ExpressRoute circuit; it does not replace ExpressRoute provider failover testing for the constraint in this scenario.

This alternative checks provider provisioning, BGP state and Azure connection health before making changes, which solves a different networking task. It does not directly validate routing and application failover across configured independent ExpressRoute paths.

Secure Virtual WAN hub with Azure Firewall deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection. The current problem instead requires a control that routes Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge.

Azure Firewall Basic for simple network filtering is useful when the goal is to fit eligible smaller workloads when advanced throughput and security features are not required. Here, the required behavior is to route Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge.

Azure Firewall DNAT rule is useful when the goal is to translate an approved public destination address and port to a protected internal service. Here, the required behavior is to route Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge.

This choice permits the specified subnet at the target managed service after a service endpoint is enabled. It leaves the specific need to associate an approved service endpoint policy with the intended endpoint-enabled workload subnet unaddressed.

That approach verifies whether the selected PaaS resource type supports service endpoints before planning access; it does not replace Service endpoint policy subnet binding for the constraint in this scenario.

Service endpoint policy for storage resource scope restricts supported endpoint traffic from a subnet to specifically allowed Azure Storage resources. The current problem instead requires a control that associates an approved service endpoint policy with the intended endpoint-enabled workload subnet.

Private DNS zone group on private endpoint is useful when the goal is to integrate an endpoint with the appropriate private DNS zone records where supported. Here, the required behavior is to deploy a supported private endpoint NIC in the correct consumer VNet subnet.

Although Private Endpoint subresource selection targets the correct service resource and subresource in a private endpoint connection, that is not sufficient to deploy a supported private endpoint NIC in the correct consumer VNet subnet in this case.

Although Private Endpoint for PaaS private IP access exposes a supported Azure service through a private IP interface in the consumer VNet, that is not sufficient to deploy a supported private endpoint NIC in the correct consumer VNet subnet in this case.

Load Balancer backend pool membership is useful when the goal is to select the intended backend network interfaces or IPs that receive distributed traffic. Here, the required behavior is to insert a supported third-party network virtual appliance fleet transparently into traffic paths.

Load Balancer HA ports enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. The current problem instead requires a control that inserts a supported third-party network virtual appliance fleet transparently into traffic paths.

Load Balancer outbound rule controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend. The current problem instead requires a control that inserts a supported third-party network virtual appliance fleet transparently into traffic paths.

Regional Azure Load Balancer for L4 traffic distributes TCP or UDP flows to healthy backend instances in an Azure region. The current problem instead requires a control that chooses between geographically distributed public endpoints through DNS responses.

This choice defines a frontend protocol/port and backend pool mapping for distributed connections. It leaves the specific need to choose between geographically distributed public endpoints through DNS responses unaddressed.

This alternative uses endpoint status probes to determine which DNS endpoints remain eligible, which solves a different networking task. It does not directly choose between geographically distributed public endpoints through DNS responses.

This choice selects different backends based on URL path patterns. It leaves the specific need to modify a supported request or response header or URL before upstream routing unaddressed.

Application Gateway custom health probe checks an application-specific path and expected response before including backends. The current problem instead requires a control that modifies a supported request or response header or URL before upstream routing.

Application Gateway for regional HTTP routing is useful when the goal is to provide managed regional Layer 7 routing, TLS termination and web traffic distribution. Here, the required behavior is to modify a supported request or response header or URL before upstream routing.