Microsoft AZ-700 Bundle

Although Application Gateway HTTP listener matches incoming protocol, port and optional host name before routing requests, that is not sufficient to define application servers, scale sets or FQDN destinations receiving proxied requests in this case.

Application Gateway end-to-end TLS is useful when the goal is to re-encrypt or retains HTTPS between the gateway and validated backend endpoints. Here, the required behavior is to define application servers, scale sets or FQDN destinations receiving proxied requests.

That approach terminates client HTTPS on the gateway with the appropriate certificate and listener; it does not replace Application Gateway backend pool for the constraint in this scenario.

Private DNS zone group on private endpoint integrates an endpoint with the appropriate private DNS zone records where supported. The current problem instead requires a control that maps the service's normal FQDN to its private endpoint IP address for authorized clients.

This alternative uses the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients, which solves a different networking task. It does not directly map the service's normal FQDN to its private endpoint IP address for authorized clients.

That approach exposes a supported Azure service through a private IP interface in the consumer VNet; it does not replace Private Endpoint DNS A-record integration for the constraint in this scenario.

That approach centralizes managed firewall settings and reusable rule collections; it does not replace Firewall logs and threat intelligence monitoring for the constraint in this scenario.

That approach organizes matching firewall rules with correct ordering and actions; it does not replace Firewall logs and threat intelligence monitoring for the constraint in this scenario.

Firewall forced tunneling via approved next hop routes Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge. The current problem instead requires a control that uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic.

This alternative restricts eligible consumers through controlled visibility and approval settings, which solves a different networking task. It does not directly expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link.

This choice inspects connection state and service-side approvals during private-link troubleshooting. It leaves the specific need to expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link unaddressed.

This choice exposes a supported Azure service through a private IP interface in the consumer VNet. It leaves the specific need to expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link unaddressed.

ASG-based NSG access rule is useful when the goal is to reference application security groups as source or destination in supported NSG rules. Here, the required behavior is to group VM interfaces by application role for NSG rule targeting.

This choice provides managed remote VM access without exposing RDP or SSH public IPs on each VM. It leaves the specific need to group VM interfaces by application role for NSG rule targeting unaddressed.

Although NSG rule priority and first-match evaluation ensures a more specific permitted or denied flow is evaluated in the intended priority order, that is not sufficient to group VM interfaces by application role for NSG rule targeting in this case.

That approach prevents address collisions between Azure networks and corporate routes; it does not replace Address-prefix growth and readdress planning for the constraint in this scenario.

This choice accounts for Azure-reserved addresses and workload growth in each subnet. It leaves the specific need to expand address capacity while managing dependencies and routing effects unaddressed.

This choice assigns an intended stable private address to a VM network interface within its subnet. It leaves the specific need to expand address capacity while managing dependencies and routing effects unaddressed.

Route table association to subnet applies a defined user route collection to the workload subnet. The current problem instead requires a control that applies a NAT Gateway's outbound SNAT behavior to a selected subnet.

This choice provides scalable managed outbound connectivity for private subnet workloads. It leaves the specific need to apply a NAT Gateway's outbound SNAT behavior to a selected subnet unaddressed.

This choice connects two Azure virtual networks over the Microsoft backbone without a VPN appliance. It leaves the specific need to apply a NAT Gateway's outbound SNAT behavior to a selected subnet unaddressed.

This choice creates the provider-backed private connectivity circuit before linking Azure VNets. It leaves the specific need to validate routing and application failover across configured independent ExpressRoute paths unaddressed.

This choice uses supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone. It leaves the specific need to validate routing and application failover across configured independent ExpressRoute paths unaddressed.

This alternative provides private routing to VNet private address spaces over an ExpressRoute circuit, which solves a different networking task. It does not directly validate routing and application failover across configured independent ExpressRoute paths.

This alternative sends selected Azure DNS queries toward other DNS servers through managed forwarding, which solves a different networking task. It does not directly store DNS records visible through linked private-network resolution rather than public DNS.

This choice registers eligible VM DNS records automatically in a linked private DNS zone. It leaves the specific need to store DNS records visible through linked private-network resolution rather than public DNS unaddressed.

Azure DNS Private Resolver inbound endpoint is useful when the goal is to accept DNS queries arriving from on-premises or connected networks into Azure resolution. Here, the required behavior is to store DNS records visible through linked private-network resolution rather than public DNS.

That approach selects the intended backend network interfaces or IPs that receive distributed traffic; it does not replace Load Balancer load-balancing rule for the constraint in this scenario.

This choice provides an Internet-routable Layer 4 frontend for approved external clients. It leaves the specific need to define a frontend protocol/port and backend pool mapping for distributed connections unaddressed.

Although Load Balancer inbound NAT rule maps a selected frontend IP and port to an individual backend VM and port, that is not sufficient to define a frontend protocol/port and backend pool mapping for distributed connections in this case.

This alternative ensures private addresses belong to the selected subnet and interface configuration, which solves a different networking task. It does not directly track CIDR ownership, free space and subnet relationships before deployment.

This alternative provides the reserved firewall subnet for the managed Azure Firewall deployment, which solves a different networking task. It does not directly track CIDR ownership, free space and subnet relationships before deployment.

Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet. The current problem instead requires a control that tracks CIDR ownership, free space and subnet relationships before deployment.