Microsoft AZ-700 Bundle

Azure Firewall Basic for simple network filtering fits eligible smaller workloads when advanced throughput and security features are not required. The current problem instead requires a control that places Azure Firewall in its designated subnet with the required supported size.

This alternative deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection, which solves a different networking task. It does not directly place Azure Firewall in its designated subnet with the required supported size.

This choice applies FQDN- or application-aware outbound access controls for supported protocols. It leaves the specific need to place Azure Firewall in its designated subnet with the required supported size unaddressed.

This alternative accepts DNS queries arriving from on-premises or connected networks into Azure resolution, which solves a different networking task. It does not directly send selected Azure DNS queries toward other DNS servers through managed forwarding.

Azure-provided DNS for VNet hostnames is useful when the goal is to resolve supported internal hostnames using default Azure DNS within a VNet. Here, the required behavior is to send selected Azure DNS queries toward other DNS servers through managed forwarding.

This alternative stores DNS records visible through linked private-network resolution rather than public DNS, which solves a different networking task. It does not directly send selected Azure DNS queries toward other DNS servers through managed forwarding.

That approach provides centrally proxied DNS resolution for supported FQDN-based network policy; it does not replace Azure Firewall Manager for fleet governance for the constraint in this scenario.

Secure Virtual WAN hub with Azure Firewall deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection. The current problem instead requires a control that manages and monitors multiple cloud firewalls and supported secure hubs centrally.

AzureFirewallSubnet deployment prerequisite is useful when the goal is to place Azure Firewall in its designated subnet with the required supported size. Here, the required behavior is to manage and monitors multiple cloud firewalls and supported secure hubs centrally.

This alternative applies a network security group to all eligible network interfaces in a selected subnet, which solves a different networking task. It does not directly apply additional instance-specific NSG rules to a selected network interface.

Although ASG-based NSG access rule references application security groups as source or destination in supported NSG rules, that is not sufficient to apply additional instance-specific NSG rules to a selected network interface in this case.

This alternative restricts workloads initiating network connections toward disallowed destinations, which solves a different networking task. It does not directly apply additional instance-specific NSG rules to a selected network interface.

This alternative connects two Azure virtual networks over the Microsoft backbone without a VPN appliance, which solves a different networking task. It does not directly update peering awareness after VNet address-space changes.

User-defined route to virtual appliance is useful when the goal is to direct selected subnet traffic to a nominated next-hop NVA address. Here, the required behavior is to update peering awareness after VNet address-space changes.

That approach links the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution; it does not replace VNet address-space peering sync for the constraint in this scenario.

Public Load Balancer frontend provides an Internet-routable Layer 4 frontend for approved external clients. The current problem instead requires a control that exposes a private VNet IP address for a load-balanced service rather than a public endpoint.

Although Load Balancer outbound rule controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend, that is not sufficient to expose a private VNet IP address for a load-balanced service rather than a public endpoint in this case.

This alternative enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios, which solves a different networking task. It does not directly expose a private VNet IP address for a load-balanced service rather than a public endpoint.

Front Door end-to-end TLS protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings. The current problem instead requires a control that caches eligible static web responses at the global edge under explicit policy.

This choice applies supported application-layer rules at the globally distributed edge. It leaves the specific need to cache eligible static web responses at the global edge under explicit policy unaddressed.

That approach provides globally distributed edge entry points with accelerated HTTP/S routing to origins; it does not replace Front Door caching configuration for the constraint in this scenario.

This alternative checks identity, certificates and local profile logs before changing gateway routes, which solves a different networking task. It does not directly authenticate supported VPN clients using the organization's Entra identity platform.

This alternative uses an existing supported RADIUS server for VPN user authentication, which solves a different networking task. It does not directly authenticate supported VPN clients using the organization's Entra identity platform.

This choice validates certificate-authenticated VPN clients against an uploaded trusted root. It leaves the specific need to authenticate supported VPN clients using the organization's Entra identity platform unaddressed.

That approach tracks CIDR ownership, free space and subnet relationships before deployment; it does not replace AzureFirewallSubnet sizing for the constraint in this scenario.

Subnet size and reserved IP planning is useful when the goal is to account for Azure-reserved addresses and workload growth in each subnet. Here, the required behavior is to provide the reserved firewall subnet for the managed Azure Firewall deployment.

This choice allocates the reserved gateway subnet used by Azure VPN or ExpressRoute gateways. It leaves the specific need to provide the reserved firewall subnet for the managed Azure Firewall deployment unaddressed.

Although WAF on Application Gateway for regional web protection inspects HTTP/S requests at a regional application gateway using supported WAF policies, that is not sufficient to block HTTP requests that match configured WAF enforcement rules in this case.

Although WAF diagnostic logging and investigation correlates WAF rule IDs, policy actions and client requests to investigate web filtering, that is not sufficient to block HTTP requests that match configured WAF enforcement rules in this case.

This alternative logs matching malicious patterns without blocking legitimate traffic during a controlled baseline, which solves a different networking task. It does not directly block HTTP requests that match configured WAF enforcement rules.

NSG effective rule inspection reads merged effective rules after both subnet and NIC associations. The current problem instead requires a control that applies a network security group to all eligible network interfaces in a selected subnet.

This choice groups VM interfaces by application role for NSG rule targeting. It leaves the specific need to apply a network security group to all eligible network interfaces in a selected subnet unaddressed.

NSG network interface association applies additional instance-specific NSG rules to a selected network interface. The current problem instead requires a control that applies a network security group to all eligible network interfaces in a selected subnet.