Microsoft AZ-700 Bundle

This alternative updates peering awareness after VNet address-space changes, which solves a different networking task. It does not directly permit forwarded packets between peered VNets through a hub appliance where appropriate.

Although VNet peering for private backbone connectivity connects two Azure virtual networks over the Microsoft backbone without a VPN appliance, that is not sufficient to permit forwarded packets between peered VNets through a hub appliance where appropriate in this case.

Gateway transit on hub peering is useful when the goal is to let an eligible peered spoke use a hub's VPN or ExpressRoute gateway. Here, the required behavior is to permit forwarded packets between peered VNets through a hub appliance where appropriate.

Although Load Balancer inbound NAT rule maps a selected frontend IP and port to an individual backend VM and port, that is not sufficient to control SNAT for backend VMs that require outbound connectivity using a load-balancer frontend in this case.

This alternative uses the current supported load balancer SKU with configurable health and security behavior, which solves a different networking task. It does not directly control SNAT for backend VMs that require outbound connectivity using a load-balancer frontend.

That approach defines a frontend protocol/port and backend pool mapping for distributed connections; it does not replace Load Balancer outbound rule for the constraint in this scenario.

That approach connects the matching frontend domain/path to the intended origin group; it does not replace Front Door origin health probe for the constraint in this scenario.

Front Door origin group priority failover selects healthy primary and secondary origins using configured priority and health. The current problem instead requires a control that checks origin availability from the edge to exclude unhealthy backends.

This choice protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings. It leaves the specific need to check origin availability from the edge to exclude unhealthy backends unaddressed.

That approach provisions the Azure-managed VPN gateway attached to the target VNet; it does not replace S2S reachability verification beyond tunnel state for the constraint in this scenario.

That approach aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device; it does not replace S2S reachability verification beyond tunnel state for the constraint in this scenario.

Although VPN connection status and tunnel diagnostics inspects tunnel state, negotiated parameters and gateway logs before changing routes, that is not sufficient to validate routing, NSGs and return paths after IPsec reports connected in this case.

This alternative delivers the correct gateway endpoints, routes and authentication settings to client devices, which solves a different networking task. It does not directly validate supported OS, client version, tunnel profile and endpoint requirements.

This alternative provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel, which solves a different networking task. It does not directly validate supported OS, client version, tunnel profile and endpoint requirements.

Although P2S client-side authentication troubleshooting checks identity, certificates and local profile logs before changing gateway routes, that is not sufficient to validate supported OS, client version, tunnel profile and endpoint requirements in this case.

Although Network Watcher connection troubleshoot tests end-to-end reachability, latency and network obstacles between source and destination, that is not sufficient to capture scoped packet evidence from a supported VM for protocol troubleshooting in this case.

This choice identifies an NSG rule that allows or denies a specified VM traffic flow. It leaves the specific need to capture scoped packet evidence from a supported VM for protocol troubleshooting unaddressed.

Although Network Watcher next hop determines a VM's effective route and next-hop category to a destination, that is not sufficient to capture scoped packet evidence from a supported VM for protocol troubleshooting in this case.

Although DNS private endpoint record validation confirms private service FQDNs resolve to the intended private endpoint addresses, that is not sufficient to send selected Azure DNS queries toward other DNS servers through managed forwarding in this case.

Azure-provided DNS for VNet hostnames resolves supported internal hostnames using default Azure DNS within a VNet. The current problem instead requires a control that sends selected Azure DNS queries toward other DNS servers through managed forwarding.

That approach stores DNS records visible through linked private-network resolution rather than public DNS; it does not replace Azure DNS Private Resolver outbound endpoint for the constraint in this scenario.

This alternative checks both forward and return routing when traffic crosses a central firewall or appliance, which solves a different networking task. It does not directly send Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop.

User-defined route to virtual appliance is useful when the goal is to direct selected subnet traffic to a nominated next-hop NVA address. Here, the required behavior is to send Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop.

This choice reveals which system, BGP or user route determines an actual VM next hop. It leaves the specific need to send Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop unaddressed.

Although Private Endpoint resource-specific authorization scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions, that is not sufficient to restrict eligible consumers through controlled visibility and approval settings in this case.

That approach updates endpoint connections, DNS and service firewall settings together during a resource move; it does not replace Private Link service access visibility for the constraint in this scenario.

Although Private Link service alias distribution gives authorized consumers a service alias to request private endpoints without using the full resource ID, that is not sufficient to restrict eligible consumers through controlled visibility and approval settings in this case.

WAF on Azure Front Door for global edge protection is useful when the goal is to inspect web traffic at Microsoft's global edge before it reaches regional origins. Here, the required behavior is to use a supported managed web attack signature rule set for common application threats.

This alternative inspects HTTP/S requests at a regional application gateway using supported WAF policies, which solves a different networking task. It does not directly use a supported managed web attack signature rule set for common application threats.

This alternative correlates WAF rule IDs, policy actions and client requests to investigate web filtering, which solves a different networking task. It does not directly use a supported managed web attack signature rule set for common application threats.

This alternative aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device, which solves a different networking task. It does not directly align corporate firewall route, access and selector rules with Azure connection design.

Although Route-based site-to-site VPN gateway supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device, that is not sufficient to align corporate firewall route, access and selector rules with Azure connection design in this case.

Active-active VPN gateway design is useful when the goal is to use multiple gateway instances and connections for supported VPN link resiliency. Here, the required behavior is to align corporate firewall route, access and selector rules with Azure connection design.