Microsoft AZ-700 Bundle

Although Load Balancer inbound NAT rule maps a selected frontend IP and port to an individual backend VM and port, that is not sufficient to expose a private VNet IP address for a load-balanced service rather than a public endpoint in this case.

That approach controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend; it does not replace Internal Load Balancer frontend for the constraint in this scenario.

Load Balancer HA ports enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. The current problem instead requires a control that exposes a private VNet IP address for a load-balanced service rather than a public endpoint.

This alternative balances requests among equally prioritized healthy origins using configured weights, which solves a different networking task. It does not directly connect an eligible Front Door Premium origin privately without exposing it broadly.

Although Front Door WAF policy association applies supported application-layer rules at the globally distributed edge, that is not sufficient to connect an eligible Front Door Premium origin privately without exposing it broadly in this case.

Front Door route and origin mapping is useful when the goal is to connect the matching frontend domain/path to the intended origin group. Here, the required behavior is to connect an eligible Front Door Premium origin privately without exposing it broadly.

Although Standard Load Balancer for modern workloads uses the current supported load balancer SKU with configurable health and security behavior, that is not sufficient to provide an Internet-routable Layer 4 frontend for approved external clients in this case.

Load Balancer outbound rule is useful when the goal is to control SNAT for backend VMs that require outbound connectivity using a load-balancer frontend. Here, the required behavior is to provide an Internet-routable Layer 4 frontend for approved external clients.

Internal Load Balancer frontend is useful when the goal is to expose a private VNet IP address for a load-balanced service rather than a public endpoint. Here, the required behavior is to provide an Internet-routable Layer 4 frontend for approved external clients.

That approach onboards an organization's eligible public IPv4 address block into Azure; it does not replace Public IP SKU and zone suitability for the constraint in this scenario.

That approach attaches the public IP to the correct network interface IP configuration; it does not replace Public IP SKU and zone suitability for the constraint in this scenario.

Although Subnet network policy placement places security and routing policies on the workload subnet rather than assuming a public IP defines security, that is not sufficient to select the supported public IP SKU and zone behavior for the intended resource and region in this case.

That approach fits eligible smaller workloads when advanced throughput and security features are not required; it does not replace Firewall forced tunneling via approved next hop for the constraint in this scenario.

That approach uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic; it does not replace Firewall forced tunneling via approved next hop for the constraint in this scenario.

Azure Firewall Policy across regions centralizes managed firewall settings and reusable rule collections. The current problem instead requires a control that routes Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge.

Although WAF prevention mode for active blocking blocks HTTP requests that match configured WAF enforcement rules, that is not sufficient to bind the WAF policy to the supported application gateway listener or edge domain in this case.

This choice inspects HTTP/S requests at a regional application gateway using supported WAF policies. It leaves the specific need to bind the WAF policy to the supported application gateway listener or edge domain unaddressed.

Although Custom WAF rule for scoped conditions matches an application-specific condition such as an approved IP, header or path and applies policy, that is not sufficient to bind the WAF policy to the supported application gateway listener or edge domain in this case.

This choice connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity. It leaves the specific need to check provider provisioning, BGP state and Azure connection health before making changes unaddressed.

ExpressRoute circuit provisioning creates the provider-backed private connectivity circuit before linking Azure VNets. The current problem instead requires a control that checks provider provisioning, BGP state and Azure connection health before making changes.

ExpressRoute BGP prefix advertisement exchanges approved on-premises routes over correct BGP peer sessions. The current problem instead requires a control that checks provider provisioning, BGP state and Azure connection health before making changes.

Load Balancer inbound NAT rule maps a selected frontend IP and port to an individual backend VM and port. The current problem instead requires a control that tests a configured probe endpoint or port to determine eligible healthy backends.

This choice uses the current supported load balancer SKU with configurable health and security behavior. It leaves the specific need to test a configured probe endpoint or port to determine eligible healthy backends unaddressed.

Load Balancer load-balancing rule defines a frontend protocol/port and backend pool mapping for distributed connections. The current problem instead requires a control that tests a configured probe endpoint or port to determine eligible healthy backends.

That approach assigns a routable public endpoint to a specified Azure resource when direct exposure is justified; it does not replace Public IP Prefix for contiguous outbound allocation for the constraint in this scenario.

This alternative places security and routing policies on the workload subnet rather than assuming a public IP defines security, which solves a different networking task. It does not directly reserve a managed contiguous block of standard public addresses for public IP resources.

This choice onboards an organization's eligible public IPv4 address block into Azure. It leaves the specific need to reserve a managed contiguous block of standard public addresses for public IP resources unaddressed.

WAF on Application Gateway for regional web protection is useful when the goal is to inspect HTTP/S requests at a regional application gateway using supported WAF policies. Here, the required behavior is to narrow a proven harmless match while retaining the remainder of managed protections.

This alternative blocks HTTP requests that match configured WAF enforcement rules, which solves a different networking task. It does not directly narrow a proven harmless match while retaining the remainder of managed protections.

Although Managed WAF rule set selection uses a supported managed web attack signature rule set for common application threats, that is not sufficient to narrow a proven harmless match while retaining the remainder of managed protections in this case.

Although Virtual WAN virtual hub creation deploys a Microsoft-managed regional hub for connectivity, routing and gateway services, that is not sufficient to deploy a supported third-party network virtual appliance in the managed hub solution in this case.

Although Virtual WAN secure hub with Azure Firewall integrates managed central security inspection into a Virtual WAN virtual hub, that is not sufficient to deploy a supported third-party network virtual appliance in the managed hub solution in this case.

Although Virtual WAN hub routing table association controls which route table a hub connection uses for its forwarding decisions, that is not sufficient to deploy a supported third-party network virtual appliance in the managed hub solution in this case.