Microsoft AZ-700 Bundle

Private DNS zone VNet link permits a selected VNet's resolver to query records in a private DNS zone. The current problem instead requires a control that links a forwarding ruleset to the VNets that need to use it.

This alternative matches a domain suffix and forwards queries to designated DNS target servers, which solves a different networking task. It does not directly link a forwarding ruleset to the VNets that need to use it.

That approach directs VNet-resident clients to selected DNS servers for specialized resolution; it does not replace Ruleset VNet association for the constraint in this scenario.

Although Address and subnet allocation inventory tracks CIDR ownership, free space and subnet relationships before deployment, that is not sufficient to ensure private addresses belong to the selected subnet and interface configuration in this case.

This choice uses multiple supported IP configurations on a network interface for distinct service addresses. It leaves the specific need to ensure private addresses belong to the selected subnet and interface configuration unaddressed.

This choice assigns an intended stable private address to a VM network interface within its subnet. It leaves the specific need to ensure private addresses belong to the selected subnet and interface configuration unaddressed.

Application Gateway multi-site routing is useful when the goal is to use host-based listeners to select application backends for different domain names. Here, the required behavior is to configure supported backend protocol, port, host-name and session behavior.

That approach matches incoming protocol, port and optional host name before routing requests; it does not replace Application Gateway HTTP settings for the constraint in this scenario.

This alternative re-encrypts or retains HTTPS between the gateway and validated backend endpoints, which solves a different networking task. It does not directly configure supported backend protocol, port, host-name and session behavior.

That approach accounts for Azure-reserved addresses and workload growth in each subnet; it does not replace Subnet network policy placement for the constraint in this scenario.

That approach selects the supported public IP SKU and zone behavior for the intended resource and region; it does not replace Subnet network policy placement for the constraint in this scenario.

That approach reserves a managed contiguous block of standard public addresses for public IP resources; it does not replace Subnet network policy placement for the constraint in this scenario.

Although Azure Route Server for BGP exchange exchanges dynamic routes with supported network virtual appliances over BGP, that is not sufficient to assign supported public IP or public IP prefix resources to the gateway in this case.

This alternative lets an eligible peered spoke use a hub's VPN or ExpressRoute gateway, which solves a different networking task. It does not directly assign supported public IP or public IP prefix resources to the gateway.

This alternative provides scalable managed outbound connectivity for private subnet workloads, which solves a different networking task. It does not directly assign supported public IP or public IP prefix resources to the gateway.

This choice improves data path behavior by bypassing the gateway for supported ExpressRoute data traffic. It leaves the specific need to connect a VNet to an ExpressRoute circuit through the managed gateway unaddressed.

Although ExpressRoute circuit provisioning creates the provider-backed private connectivity circuit before linking Azure VNets, that is not sufficient to connect a VNet to an ExpressRoute circuit through the managed gateway in this case.

This alternative allows an approved cross-subscription connection to an ExpressRoute circuit, which solves a different networking task. It does not directly connect a VNet to an ExpressRoute circuit through the managed gateway.

Although RADIUS authentication for P2S VPN uses an existing supported RADIUS server for VPN user authentication, that is not sufficient to advertise or includes the correct private destination prefixes in remote-user VPN profiles in this case.

P2S VPN client profile generation delivers the correct gateway endpoints, routes and authentication settings to client devices. The current problem instead requires a control that advertises or includes the correct private destination prefixes in remote-user VPN profiles.

That approach sizes point-to-site connectivity for the expected simultaneous remote clients; it does not replace P2S route distribution to clients for the constraint in this scenario.

This choice accepts DNS queries arriving from on-premises or connected networks into Azure resolution. It leaves the specific need to confirm private service FQDNs resolve to the intended private endpoint addresses unaddressed.

Azure DNS Private Resolver outbound endpoint sends selected Azure DNS queries toward other DNS servers through managed forwarding. The current problem instead requires a control that confirms private service FQDNs resolve to the intended private endpoint addresses.

This alternative hosts authoritative public DNS records under an internet-resolvable zone, which solves a different networking task. It does not directly confirm private service FQDNs resolve to the intended private endpoint addresses.

This choice chooses a supported SSL/TLS-based VPN client protocol for broad client compatibility. It leaves the specific need to use an existing supported RADIUS server for VPN user authentication unaddressed.

P2S VPN client profile generation is useful when the goal is to deliver the correct gateway endpoints, routes and authentication settings to client devices. Here, the required behavior is to use an existing supported RADIUS server for VPN user authentication.

This alternative authenticates supported VPN clients using the organization's Entra identity platform, which solves a different networking task. It does not directly use an existing supported RADIUS server for VPN user authentication.

This alternative modifies a supported request or response header or URL before upstream routing, which solves a different networking task. It does not directly check an application-specific path and expected response before including backends.

That approach uses host-based listeners to select application backends for different domain names; it does not replace Application Gateway custom health probe for the constraint in this scenario.

This choice terminates client HTTPS on the gateway with the appropriate certificate and listener. It leaves the specific need to check an application-specific path and expected response before including backends unaddressed.

Although Load Balancer inbound NAT rule maps a selected frontend IP and port to an individual backend VM and port, that is not sufficient to expose a private VNet IP address for a load-balanced service rather than a public endpoint in this case.

That approach controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend; it does not replace Internal Load Balancer frontend for the constraint in this scenario.

Load Balancer HA ports enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. The current problem instead requires a control that exposes a private VNet IP address for a load-balanced service rather than a public endpoint.