Microsoft AZ-700 Bundle

This alternative uses the current supported load balancer SKU with configurable health and security behavior, which solves a different networking task. It does not directly use supported regional frontends beneath a global load balancing layer for L4 regional resiliency.

Regional Azure Load Balancer for L4 traffic is useful when the goal is to distribute TCP or UDP flows to healthy backend instances in an Azure region. Here, the required behavior is to use supported regional frontends beneath a global load balancing layer for L4 regional resiliency.

Load Balancer HA ports enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. The current problem instead requires a control that uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency.

This alternative controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend, which solves a different networking task. It does not directly map a selected frontend IP and port to an individual backend VM and port.

Internal Load Balancer frontend exposes a private VNet IP address for a load-balanced service rather than a public endpoint. The current problem instead requires a control that maps a selected frontend IP and port to an individual backend VM and port.

Load Balancer health probe is useful when the goal is to test a configured probe endpoint or port to determine eligible healthy backends. Here, the required behavior is to map a selected frontend IP and port to an individual backend VM and port.

That approach applies additional instance-specific NSG rules to a selected network interface; it does not replace NSG remote management least privilege for the constraint in this scenario.

That approach references application security groups as source or destination in supported NSG rules; it does not replace NSG remote management least privilege for the constraint in this scenario.

Although Azure Bastion for browser-based VM administration provides managed remote VM access without exposing RDP or SSH public IPs on each VM, that is not sufficient to limit administrative connections to approved sources and ports rather than Internet-wide access in this case.

This alternative permits a selected VNet's resolver to query records in a private DNS zone, which solves a different networking task. It does not directly accept DNS queries arriving from on-premises or connected networks into Azure resolution.

This choice sends selected Azure DNS queries toward other DNS servers through managed forwarding. It leaves the specific need to accept DNS queries arriving from on-premises or connected networks into Azure resolution unaddressed.

Azure private DNS zone stores DNS records visible through linked private-network resolution rather than public DNS. The current problem instead requires a control that accepts DNS queries arriving from on-premises or connected networks into Azure resolution.

This choice advertises or includes the correct private destination prefixes in remote-user VPN profiles. It leaves the specific need to validate certificate-authenticated VPN clients against an uploaded trusted root unaddressed.

This alternative sizes point-to-site connectivity for the expected simultaneous remote clients, which solves a different networking task. It does not directly validate certificate-authenticated VPN clients against an uploaded trusted root.

That approach authenticates supported VPN clients using the organization's Entra identity platform; it does not replace P2S root certificate trust configuration for the constraint in this scenario.

Although Service endpoint unsupported-service review verifies whether the selected PaaS resource type supports service endpoints before planning access, that is not sufficient to associate an approved service endpoint policy with the intended endpoint-enabled workload subnet in this case.

VNet service endpoint enablement is useful when the goal is to extend selected Azure service routing and service identity from an approved VNet subnet. Here, the required behavior is to associate an approved service endpoint policy with the intended endpoint-enabled workload subnet.

This choice restricts supported endpoint traffic from a subnet to specifically allowed Azure Storage resources. It leaves the specific need to associate an approved service endpoint policy with the intended endpoint-enabled workload subnet unaddressed.

This alternative permits a selected VNet's resolver to query records in a private DNS zone, which solves a different networking task. It does not directly store DNS records visible through linked private-network resolution rather than public DNS.

Azure DNS public zone delegation is useful when the goal is to host authoritative public DNS records under an internet-resolvable zone. Here, the required behavior is to store DNS records visible through linked private-network resolution rather than public DNS.

Azure DNS Private Resolver inbound endpoint is useful when the goal is to accept DNS queries arriving from on-premises or connected networks into Azure resolution. Here, the required behavior is to store DNS records visible through linked private-network resolution rather than public DNS.

That approach updates endpoint connections, DNS and service firewall settings together during a resource move; it does not replace Private Endpoint approval workflow for the constraint in this scenario.

Private Endpoint DNS A-record integration maps the service's normal FQDN to its private endpoint IP address for authorized clients. The current problem instead requires a control that requires the service owner to authorize pending private endpoint connections when necessary.

This choice scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions. It leaves the specific need to require the service owner to authorize pending private endpoint connections when necessary unaddressed.

Azure Firewall Premium for TLS inspection uses the Premium tier's supported TLS inspection and advanced threat features. The current problem instead requires a control that fits eligible smaller workloads when advanced throughput and security features are not required.

Azure Firewall network rule permits or denies supported IP-based TCP or UDP flows by addresses and ports. The current problem instead requires a control that fits eligible smaller workloads when advanced throughput and security features are not required.

Azure Firewall Standard for stateful filtering is useful when the goal is to provide managed stateful network and application filtering without Premium-only inspection. Here, the required behavior is to fit eligible smaller workloads when advanced throughput and security features are not required.

This choice connects a VNet to an ExpressRoute circuit through the managed gateway. It leaves the specific need to connect on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity unaddressed.

That approach creates the provider-backed private connectivity circuit before linking Azure VNets; it does not replace ExpressRoute Global Reach for the constraint in this scenario.

ExpressRoute private peering provides private routing to VNet private address spaces over an ExpressRoute circuit. The current problem instead requires a control that connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity.

That approach attaches the public IP to the correct network interface IP configuration; it does not replace Public IP Prefix for contiguous outbound allocation for the constraint in this scenario.

Although Subnet network policy placement places security and routing policies on the workload subnet rather than assuming a public IP defines security, that is not sufficient to reserve a managed contiguous block of standard public addresses for public IP resources in this case.

This alternative onboards an organization's eligible public IPv4 address block into Azure, which solves a different networking task. It does not directly reserve a managed contiguous block of standard public addresses for public IP resources.