Microsoft AZ-700 Bundle

This choice exposes a private VNet IP address for a load-balanced service rather than a public endpoint. It leaves the specific need to provide an Internet-routable Layer 4 frontend for approved external clients unaddressed.

Load Balancer outbound rule controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend. The current problem instead requires a control that provides an Internet-routable Layer 4 frontend for approved external clients.

This alternative uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency, which solves a different networking task. It does not directly provide an Internet-routable Layer 4 frontend for approved external clients.

Azure Firewall Basic for simple network filtering fits eligible smaller workloads when advanced throughput and security features are not required. The current problem instead requires a control that places Azure Firewall in its designated subnet with the required supported size.

Secure Virtual WAN hub with Azure Firewall deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection. The current problem instead requires a control that places Azure Firewall in its designated subnet with the required supported size.

This choice manages and monitors multiple cloud firewalls and supported secure hubs centrally. It leaves the specific need to place Azure Firewall in its designated subnet with the required supported size unaddressed.

Virtual WAN third-party NVA integration deploys a supported third-party network virtual appliance in the managed hub solution. The current problem instead requires a control that terminates VPN connections from branches within the managed virtual hub.

This alternative sizes a managed virtual-hub gateway for required bandwidth and connections, which solves a different networking task. It does not directly terminate VPN connections from branches within the managed virtual hub.

That approach supports site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology; it does not replace Virtual WAN site-to-site VPN gateway for the constraint in this scenario.

This choice aligns corporate firewall route, access and selector rules with Azure connection design. It leaves the specific need to handle a restricted legacy VPN peer that relies on specific address selectors unaddressed.

This alternative updates peer and local network gateway settings together during a branch cutover, which solves a different networking task. It does not directly handle a restricted legacy VPN peer that relies on specific address selectors.

This choice exchanges dynamic network prefixes over a supported route-based VPN configuration. It leaves the specific need to handle a restricted legacy VPN peer that relies on specific address selectors unaddressed.

This alternative provides globally distributed edge entry points with accelerated HTTP/S routing to origins, which solves a different networking task. It does not directly apply supported application-layer rules at the globally distributed edge.

This alternative connects an eligible Front Door Premium origin privately without exposing it broadly, which solves a different networking task. It does not directly apply supported application-layer rules at the globally distributed edge.

This choice protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings. It leaves the specific need to apply supported application-layer rules at the globally distributed edge unaddressed.

Ruleset VNet association links a forwarding ruleset to the VNets that need to use it. The current problem instead requires a control that tests authoritative records, zone links and conditional forwarding in the proper order.

Although Azure private DNS zone stores DNS records visible through linked private-network resolution rather than public DNS, that is not sufficient to test authoritative records, zone links and conditional forwarding in the proper order in this case.

Although Azure DNS public zone delegation hosts authoritative public DNS records under an internet-resolvable zone, that is not sufficient to test authoritative records, zone links and conditional forwarding in the proper order in this case.

This choice uses the current supported load balancer SKU with configurable health and security behavior. It leaves the specific need to use endpoint status probes to determine which DNS endpoints remain eligible unaddressed.

Although Load Balancer health probe tests a configured probe endpoint or port to determine eligible healthy backends, that is not sufficient to use endpoint status probes to determine which DNS endpoints remain eligible in this case.

This alternative chooses between geographically distributed public endpoints through DNS responses, which solves a different networking task. It does not directly use endpoint status probes to determine which DNS endpoints remain eligible.

This choice connects a VNet to an ExpressRoute circuit through the managed gateway. It leaves the specific need to exchange approved on-premises routes over correct BGP peer sessions unaddressed.

Although ExpressRoute peering and connection diagnostics checks provider provisioning, BGP state and Azure connection health before making changes, that is not sufficient to exchange approved on-premises routes over correct BGP peer sessions in this case.

Although Microsoft peering requirements on ExpressRoute enables approved Microsoft service access over Microsoft peering rather than private VNet routes, that is not sufficient to exchange approved on-premises routes over correct BGP peer sessions in this case.

Private DNS zone group on private endpoint integrates an endpoint with the appropriate private DNS zone records where supported. The current problem instead requires a control that uses the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients.

This choice uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. It leaves the specific need to use the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients unaddressed.

This choice exposes a supported Azure service through a private IP interface in the consumer VNet. It leaves the specific need to use the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients unaddressed.

That approach aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device; it does not replace On-premises VPN device policy matching for the constraint in this scenario.

This alternative records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection, which solves a different networking task. It does not directly align corporate firewall route, access and selector rules with Azure connection design.

That approach handles a restricted legacy VPN peer that relies on specific address selectors; it does not replace On-premises VPN device policy matching for the constraint in this scenario.

Azure Firewall Standard for stateful filtering provides managed stateful network and application filtering without Premium-only inspection. The current problem instead requires a control that centralizes managed firewall settings and reusable rule collections.

That approach provides centrally proxied DNS resolution for supported FQDN-based network policy; it does not replace Azure Firewall Policy across regions for the constraint in this scenario.

Although Secure Virtual WAN hub with Azure Firewall deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection, that is not sufficient to centralize managed firewall settings and reusable rule collections in this case.