Microsoft AZ-700 Bundle

That approach places a supported VPN gateway across availability zones for regional resilience; it does not replace Virtual network gateway deployment for the constraint in this scenario.

S2S peer public IP change procedure is useful when the goal is to update peer and local network gateway settings together during a branch cutover. Here, the required behavior is to provision the Azure-managed VPN gateway attached to the target VNet.

This choice records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. It leaves the specific need to provision the Azure-managed VPN gateway attached to the target VNet unaddressed.

NSG inbound rule source and port is useful when the goal is to restrict traffic entering a NIC or subnet by source, destination and service port. Here, the required behavior is to read merged effective rules after both subnet and NIC associations.

That approach tests a specified source/destination/port and reports the allowing or blocking NSG rule; it does not replace NSG effective rule inspection for the constraint in this scenario.

This alternative applies a network security group to all eligible network interfaces in a selected subnet, which solves a different networking task. It does not directly read merged effective rules after both subnet and NIC associations.

Subnet size and reserved IP planning is useful when the goal is to account for Azure-reserved addresses and workload growth in each subnet. Here, the required behavior is to delegate a subnet to a supported service so the platform can manage its integration requirements.

Address and subnet allocation inventory tracks CIDR ownership, free space and subnet relationships before deployment. The current problem instead requires a control that delegates a subnet to a supported service so the platform can manage its integration requirements.

That approach uses multiple supported IP configurations on a network interface for distinct service addresses; it does not replace Subnet delegation for PaaS integration for the constraint in this scenario.

This choice provides managed stateful network and application filtering without Premium-only inspection. It leaves the specific need to fit eligible smaller workloads when advanced throughput and security features are not required unaddressed.

This choice permits or denies supported IP-based TCP or UDP flows by addresses and ports. It leaves the specific need to fit eligible smaller workloads when advanced throughput and security features are not required unaddressed.

This choice places Azure Firewall in its designated subnet with the required supported size. It leaves the specific need to fit eligible smaller workloads when advanced throughput and security features are not required unaddressed.

This alternative allows an approved cross-subscription connection to an ExpressRoute circuit, which solves a different networking task. It does not directly enable approved Microsoft service access over Microsoft peering rather than private VNet routes.

ExpressRoute gateway on VNet is useful when the goal is to connect a VNet to an ExpressRoute circuit through the managed gateway. Here, the required behavior is to enable approved Microsoft service access over Microsoft peering rather than private VNet routes.

This choice provides private routing to VNet private address spaces over an ExpressRoute circuit. It leaves the specific need to enable approved Microsoft service access over Microsoft peering rather than private VNet routes unaddressed.

Although Application Gateway end-to-end TLS re-encrypts or retains HTTPS between the gateway and validated backend endpoints, that is not sufficient to provide managed regional Layer 7 routing, TLS termination and web traffic distribution in this case.

Although Application Gateway multi-site routing uses host-based listeners to select application backends for different domain names, that is not sufficient to provide managed regional Layer 7 routing, TLS termination and web traffic distribution in this case.

This choice terminates client HTTPS on the gateway with the appropriate certificate and listener. It leaves the specific need to provide managed regional Layer 7 routing, TLS termination and web traffic distribution unaddressed.

This choice searches security and resource context to find network assets matching risk conditions. It leaves the specific need to list the combined network security rules effective on an Azure VM interface unaddressed.

Defender for Cloud Secure Score recommendations is useful when the goal is to prioritize cloud security posture findings including exposed network resources. Here, the required behavior is to list the combined network security rules effective on an Azure VM interface.

Although Network Watcher next hop determines a VM's effective route and next-hop category to a destination, that is not sufficient to list the combined network security rules effective on an Azure VM interface in this case.

That approach exposes a private VNet IP address for a load-balanced service rather than a public endpoint; it does not replace Load Balancer HA ports for the constraint in this scenario.

This alternative uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency, which solves a different networking task. It does not directly enable a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios.

Regional Azure Load Balancer for L4 traffic distributes TCP or UDP flows to healthy backend instances in an Azure region. The current problem instead requires a control that enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios.

This alternative reserves a managed contiguous block of standard public addresses for public IP resources, which solves a different networking task. It does not directly reserve the specifically named subnet required for Azure Bastion.

AzureFirewallSubnet sizing is useful when the goal is to provide the reserved firewall subnet for the managed Azure Firewall deployment. Here, the required behavior is to reserve the specifically named subnet required for Azure Bastion.

This alternative accounts for Azure-reserved addresses and workload growth in each subnet, which solves a different networking task. It does not directly reserve the specifically named subnet required for Azure Bastion.

This choice continuously tracks network reachability and performance between configured endpoints. It leaves the specific need to prioritize cloud security posture findings including exposed network resources unaddressed.

Although Network Watcher effective security rules lists the combined network security rules effective on an Azure VM interface, that is not sufficient to prioritize cloud security posture findings including exposed network resources in this case.

This choice searches security and resource context to find network assets matching risk conditions. It leaves the specific need to prioritize cloud security posture findings including exposed network resources unaddressed.

This choice chooses a supported SSL/TLS-based VPN client protocol for broad client compatibility. It leaves the specific need to authenticate supported VPN clients using the organization's Entra identity platform unaddressed.

P2S root certificate trust configuration is useful when the goal is to validate certificate-authenticated VPN clients against an uploaded trusted root. Here, the required behavior is to authenticate supported VPN clients using the organization's Entra identity platform.

This choice uses an existing supported RADIUS server for VPN user authentication. It leaves the specific need to authenticate supported VPN clients using the organization's Entra identity platform unaddressed.