Microsoft AZ-700 Bundle

Virtual WAN hub VNet connection is useful when the goal is to attache a workload VNet to a managed virtual hub for connectivity and route propagation. Here, the required behavior is to deploy a Microsoft-managed regional hub for connectivity, routing and gateway services.

Virtual WAN hub routing table association is useful when the goal is to control which route table a hub connection uses for its forwarding decisions. Here, the required behavior is to deploy a Microsoft-managed regional hub for connectivity, routing and gateway services.

That approach terminates VPN connections from branches within the managed virtual hub; it does not replace Virtual WAN virtual hub creation for the constraint in this scenario.

Service endpoint policy subnet binding is useful when the goal is to associate an approved service endpoint policy with the intended endpoint-enabled workload subnet. Here, the required behavior is to use an approved private endpoint with hybrid DNS and VPN/ExpressRoute reachability when on-premises clients require private PaaS access.

This choice checks source subnet configuration, resource firewall rules and actual service reachability. It leaves the specific need to use an approved private endpoint with hybrid DNS and VPN/ExpressRoute reachability when on-premises clients require private PaaS access unaddressed.

This choice verifies whether the selected PaaS resource type supports service endpoints before planning access. It leaves the specific need to use an approved private endpoint with hybrid DNS and VPN/ExpressRoute reachability when on-premises clients require private PaaS access unaddressed.

That approach defines which routes are advertised into selected hub route tables and connection groups; it does not replace Virtual WAN hub routing table association for the constraint in this scenario.

This choice deploys a Microsoft-managed regional hub for connectivity, routing and gateway services. It leaves the specific need to control which route table a hub connection uses for its forwarding decisions unaddressed.

Virtual WAN site-to-site VPN gateway is useful when the goal is to terminate VPN connections from branches within the managed virtual hub. Here, the required behavior is to control which route table a hub connection uses for its forwarding decisions.

This choice logs matching malicious patterns without blocking legitimate traffic during a controlled baseline. It leaves the specific need to match an application-specific condition such as an approved IP, header or path and applies policy unaddressed.

Although Managed WAF rule set selection uses a supported managed web attack signature rule set for common application threats, that is not sufficient to match an application-specific condition such as an approved IP, header or path and applies policy in this case.

Although WAF diagnostic logging and investigation correlates WAF rule IDs, policy actions and client requests to investigate web filtering, that is not sufficient to match an application-specific condition such as an approved IP, header or path and applies policy in this case.

This choice applies a defined user route collection to the workload subnet. It leaves the specific need to direct selected subnet traffic to a nominated next-hop NVA address unaddressed.

This alternative applies a NAT Gateway's outbound SNAT behavior to a selected subnet, which solves a different networking task. It does not directly direct selected subnet traffic to a nominated next-hop NVA address.

Although Allow forwarded traffic on VNet peering permits forwarded packets between peered VNets through a hub appliance where appropriate, that is not sufficient to direct selected subnet traffic to a nominated next-hop NVA address in this case.

P2S client address pool planning is useful when the goal is to allocate remote-user tunnel addresses without overlapping VNet and on-premises ranges. Here, the required behavior is to size point-to-site connectivity for the expected simultaneous remote clients.

Although P2S client-side authentication troubleshooting checks identity, certificates and local profile logs before changing gateway routes, that is not sufficient to size point-to-site connectivity for the expected simultaneous remote clients in this case.

That approach provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel; it does not replace P2S gateway SKU and concurrent-user limits for the constraint in this scenario.

P2S client-side authentication troubleshooting is useful when the goal is to check identity, certificates and local profile logs before changing gateway routes. Here, the required behavior is to allocate remote-user tunnel addresses without overlapping VNet and on-premises ranges.

Although P2S gateway SKU and concurrent-user limits sizes point-to-site connectivity for the expected simultaneous remote clients, that is not sufficient to allocate remote-user tunnel addresses without overlapping VNet and on-premises ranges in this case.

This choice advertises or includes the correct private destination prefixes in remote-user VPN profiles. It leaves the specific need to allocate remote-user tunnel addresses without overlapping VNet and on-premises ranges unaddressed.

This alternative applies FQDN- or application-aware outbound access controls for supported protocols, which solves a different networking task. It does not directly provide managed stateful network and application filtering without Premium-only inspection.

This alternative deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection, which solves a different networking task. It does not directly provide managed stateful network and application filtering without Premium-only inspection.

This alternative uses the Premium tier's supported TLS inspection and advanced threat features, which solves a different networking task. It does not directly provide managed stateful network and application filtering without Premium-only inspection.

This alternative allows an approved cross-subscription connection to an ExpressRoute circuit, which solves a different networking task. It does not directly select supported capacity, metering and reach based on enterprise traffic needs.

ExpressRoute FastPath is useful when the goal is to improve data path behavior by bypassing the gateway for supported ExpressRoute data traffic. Here, the required behavior is to select supported capacity, metering and reach based on enterprise traffic needs.

That approach connects a VNet to an ExpressRoute circuit through the managed gateway; it does not replace ExpressRoute circuit bandwidth and SKU design for the constraint in this scenario.

This choice organizes matching firewall rules with correct ordering and actions. It leaves the specific need to provide centrally proxied DNS resolution for supported FQDN-based network policy unaddressed.

That approach provides managed stateful network and application filtering without Premium-only inspection; it does not replace Azure Firewall DNS proxy for the constraint in this scenario.

That approach permits or denies supported IP-based TCP or UDP flows by addresses and ports; it does not replace Azure Firewall DNS proxy for the constraint in this scenario.

Although Application Gateway HTTP listener matches incoming protocol, port and optional host name before routing requests, that is not sufficient to define application servers, scale sets or FQDN destinations receiving proxied requests in this case.

Application Gateway end-to-end TLS is useful when the goal is to re-encrypt or retains HTTPS between the gateway and validated backend endpoints. Here, the required behavior is to define application servers, scale sets or FQDN destinations receiving proxied requests.

That approach terminates client HTTPS on the gateway with the appropriate certificate and listener; it does not replace Application Gateway backend pool for the constraint in this scenario.