Microsoft AZ-700 Bundle

This choice applies additional instance-specific NSG rules to a selected network interface. It leaves the specific need to restrict workloads initiating network connections toward disallowed destinations unaddressed.

This choice references application security groups as source or destination in supported NSG rules. It leaves the specific need to restrict workloads initiating network connections toward disallowed destinations unaddressed.

Although NSG inbound rule source and port restricts traffic entering a NIC or subnet by source, destination and service port, that is not sufficient to restrict workloads initiating network connections toward disallowed destinations in this case.

NIC-level public IP association is useful when the goal is to attache the public IP to the correct network interface IP configuration. Here, the required behavior is to assign an intended stable private address to a VM network interface within its subnet.

This alternative assigns a routable public endpoint to a specified Azure resource when direct exposure is justified, which solves a different networking task. It does not directly assign an intended stable private address to a VM network interface within its subnet.

That approach uses multiple supported IP configurations on a network interface for distinct service addresses; it does not replace Static private NIC IP configuration for the constraint in this scenario.

Microsoft Entra ID P2S authentication authenticates supported VPN clients using the organization's Entra identity platform. The current problem instead requires a control that chooses a supported SSL/TLS-based VPN client protocol for broad client compatibility.

This choice validates supported OS, client version, tunnel profile and endpoint requirements. It leaves the specific need to choose a supported SSL/TLS-based VPN client protocol for broad client compatibility unaddressed.

That approach uses an existing supported RADIUS server for VPN user authentication; it does not replace P2S OpenVPN protocol selection for the constraint in this scenario.

Allow forwarded traffic on VNet peering permits forwarded packets between peered VNets through a hub appliance where appropriate. The current problem instead requires a control that updates peering awareness after VNet address-space changes.

User-defined route to virtual appliance is useful when the goal is to direct selected subnet traffic to a nominated next-hop NVA address. Here, the required behavior is to update peering awareness after VNet address-space changes.

That approach connects two Azure virtual networks over the Microsoft backbone without a VPN appliance; it does not replace VNet address-space peering sync for the constraint in this scenario.

Front Door end-to-end TLS is useful when the goal is to protect client-to-edge and edge-to-origin traffic with compatible HTTPS settings. Here, the required behavior is to return an HTTP redirect to the client for an approved URL transformation.

Although Front Door custom domain binding configures an approved domain, DNS validation and certificate for the edge endpoint, that is not sufficient to return an HTTP redirect to the client for an approved URL transformation in this case.

Although Front Door Rules Engine rewrite changes the upstream URL path while the client's visible URL remains stable, that is not sufficient to return an HTTP redirect to the client for an approved URL transformation in this case.

Although Service-specific subnet isolation keeps dedicated platform subnets separate from shared workload subnets, that is not sufficient to reserve the specifically named subnet required for Azure Bastion in this case.

This choice allocates the reserved gateway subnet used by Azure VPN or ExpressRoute gateways. It leaves the specific need to reserve the specifically named subnet required for Azure Bastion unaddressed.

Although Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet, that is not sufficient to reserve the specifically named subnet required for Azure Bastion in this case.

ExpressRoute peering and connection diagnostics is useful when the goal is to check provider provisioning, BGP state and Azure connection health before making changes. Here, the required behavior is to enable approved Microsoft service access over Microsoft peering rather than private VNet routes.

ExpressRoute gateway on VNet is useful when the goal is to connect a VNet to an ExpressRoute circuit through the managed gateway. Here, the required behavior is to enable approved Microsoft service access over Microsoft peering rather than private VNet routes.

This choice provides private routing to VNet private address spaces over an ExpressRoute circuit. It leaves the specific need to enable approved Microsoft service access over Microsoft peering rather than private VNet routes unaddressed.

Private DNS zone auto-registration link is useful when the goal is to register eligible VM DNS records automatically in a linked private DNS zone. Here, the required behavior is to store DNS records visible through linked private-network resolution rather than public DNS.

This alternative resolves supported internal hostnames using default Azure DNS within a VNet, which solves a different networking task. It does not directly store DNS records visible through linked private-network resolution rather than public DNS.

This choice permits a selected VNet's resolver to query records in a private DNS zone. It leaves the specific need to store DNS records visible through linked private-network resolution rather than public DNS unaddressed.

This alternative requires appropriate VPN, ExpressRoute or peering connectivity before remote networks can route to a private endpoint IP, which solves a different networking task. It does not directly give authorized consumers a service alias to request private endpoints without using the full resource ID.

This choice restricts eligible consumers through controlled visibility and approval settings. It leaves the specific need to give authorized consumers a service alias to request private endpoints without using the full resource ID unaddressed.

Private Link service provider design is useful when the goal is to expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link. Here, the required behavior is to give authorized consumers a service alias to request private endpoints without using the full resource ID.

P2S VPN client profile generation delivers the correct gateway endpoints, routes and authentication settings to client devices. The current problem instead requires a control that validates supported OS, client version, tunnel profile and endpoint requirements.

P2S client address pool planning allocates remote-user tunnel addresses without overlapping VNet and on-premises ranges. The current problem instead requires a control that validates supported OS, client version, tunnel profile and endpoint requirements.

This alternative provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel, which solves a different networking task. It does not directly validate supported OS, client version, tunnel profile and endpoint requirements.

Private DNS zone VNet link permits a selected VNet's resolver to query records in a private DNS zone. The current problem instead requires a control that links a forwarding ruleset to the VNets that need to use it.

This alternative matches a domain suffix and forwards queries to designated DNS target servers, which solves a different networking task. It does not directly link a forwarding ruleset to the VNets that need to use it.

That approach directs VNet-resident clients to selected DNS servers for specialized resolution; it does not replace Ruleset VNet association for the constraint in this scenario.