Microsoft AZ-700 Bundle

Although Azure Bastion for browser-based VM administration provides managed remote VM access without exposing RDP or SSH public IPs on each VM, that is not sufficient to limit administrative connections to approved sources and ports rather than Internet-wide access in this case.

This alternative restricts workloads initiating network connections toward disallowed destinations, which solves a different networking task. It does not directly limit administrative connections to approved sources and ports rather than Internet-wide access.

This choice tests a specified source/destination/port and reports the allowing or blocking NSG rule. It leaves the specific need to limit administrative connections to approved sources and ports rather than Internet-wide access unaddressed.

Although Private Endpoint subnet placement deploys a supported private endpoint NIC in the correct consumer VNet subnet, that is not sufficient to integrate an endpoint with the appropriate private DNS zone records where supported in this case.

Private Endpoint DNS A-record integration is useful when the goal is to map the service's normal FQDN to its private endpoint IP address for authorized clients. Here, the required behavior is to integrate an endpoint with the appropriate private DNS zone records where supported.

This alternative uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint, which solves a different networking task. It does not directly integrate an endpoint with the appropriate private DNS zone records where supported.

Although Zone-redundant VPN Gateway places a supported VPN gateway across availability zones for regional resilience, that is not sufficient to provision the Azure-managed VPN gateway attached to the target VNet in this case.

Active-active VPN gateway design uses multiple gateway instances and connections for supported VPN link resiliency. The current problem instead requires a control that provisions the Azure-managed VPN gateway attached to the target VNet.

Although Local network gateway configuration records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection, that is not sufficient to provision the Azure-managed VPN gateway attached to the target VNet in this case.

That approach links a forwarding ruleset to the VNets that need to use it; it does not replace DNS forwarding ruleset and rules for the constraint in this scenario.

This choice stores DNS records visible through linked private-network resolution rather than public DNS. It leaves the specific need to match a domain suffix and forwards queries to designated DNS target servers unaddressed.

Azure DNS Private Resolver outbound endpoint is useful when the goal is to send selected Azure DNS queries toward other DNS servers through managed forwarding. Here, the required behavior is to match a domain suffix and forwards queries to designated DNS target servers.

Private Endpoint NSG and route policy support is useful when the goal is to apply enabled private endpoint network policies when traffic inspection or subnet filtering is needed. Here, the required behavior is to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint.

Although Private Endpoint hostname-specific TLS handling uses the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients, that is not sufficient to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint in this case.

That approach requires appropriate VPN, ExpressRoute or peering connectivity before remote networks can route to a private endpoint IP; it does not replace Private Endpoint from on-premises via hybrid route for the constraint in this scenario.

This choice controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend. It leaves the specific need to distribute TCP or UDP flows to healthy backend instances in an Azure region unaddressed.

Load Balancer backend pool membership is useful when the goal is to select the intended backend network interfaces or IPs that receive distributed traffic. Here, the required behavior is to distribute TCP or UDP flows to healthy backend instances in an Azure region.

Cross-region Azure Load Balancer design uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency. The current problem instead requires a control that distributes TCP or UDP flows to healthy backend instances in an Azure region.

That approach scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions; it does not replace Private Endpoint subresource selection for the constraint in this scenario.

This choice updates endpoint connections, DNS and service firewall settings together during a resource move. It leaves the specific need to target the correct service resource and subresource in a private endpoint connection unaddressed.

This choice deploys a supported private endpoint NIC in the correct consumer VNet subnet. It leaves the specific need to target the correct service resource and subresource in a private endpoint connection unaddressed.

That approach selects the intended backend network interfaces or IPs that receive distributed traffic; it does not replace Load Balancer outbound rule for the constraint in this scenario.

This alternative defines a frontend protocol/port and backend pool mapping for distributed connections, which solves a different networking task. It does not directly control SNAT for backend VMs that require outbound connectivity using a load-balancer frontend.

That approach provides an Internet-routable Layer 4 frontend for approved external clients; it does not replace Load Balancer outbound rule for the constraint in this scenario.

This alternative selects supported capacity, metering and reach based on enterprise traffic needs, which solves a different networking task. It does not directly improve data path behavior by bypassing the gateway for supported ExpressRoute data traffic.

ExpressRoute encryption over private connectivity adds a supported encryption overlay when private circuit transport alone is insufficient. The current problem instead requires a control that improves data path behavior by bypassing the gateway for supported ExpressRoute data traffic.

This alternative provides dedicated high-capacity direct ports at a supported peering location, which solves a different networking task. It does not directly improve data path behavior by bypassing the gateway for supported ExpressRoute data traffic.

Although Network Watcher packet capture captures scoped packet evidence from a supported VM for protocol troubleshooting, that is not sufficient to identify an NSG rule that allows or denies a specified VM traffic flow in this case.

Network Watcher next hop determines a VM's effective route and next-hop category to a destination. The current problem instead requires a control that identifies an NSG rule that allows or denies a specified VM traffic flow.

That approach identifies exploitable attack paths that connect exposure and privilege to important assets; it does not replace Network Watcher IP flow verify for the constraint in this scenario.

That approach places a supported VPN gateway across availability zones for regional resilience; it does not replace Virtual network gateway deployment for the constraint in this scenario.

S2S peer public IP change procedure is useful when the goal is to update peer and local network gateway settings together during a branch cutover. Here, the required behavior is to provision the Azure-managed VPN gateway attached to the target VNet.

This choice records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. It leaves the specific need to provision the Azure-managed VPN gateway attached to the target VNet unaddressed.