Microsoft AZ-700 Bundle

This choice chooses a supported SSL/TLS-based VPN client protocol for broad client compatibility. It leaves the specific need to authenticate supported VPN clients using the organization's Entra identity platform unaddressed.

P2S root certificate trust configuration is useful when the goal is to validate certificate-authenticated VPN clients against an uploaded trusted root. Here, the required behavior is to authenticate supported VPN clients using the organization's Entra identity platform.

This choice uses an existing supported RADIUS server for VPN user authentication. It leaves the specific need to authenticate supported VPN clients using the organization's Entra identity platform unaddressed.

That approach permits forwarded packets between peered VNets through a hub appliance where appropriate; it does not replace Private DNS zone access for peered VNets for the constraint in this scenario.

NAT Gateway for predictable outbound SNAT is useful when the goal is to provide scalable managed outbound connectivity for private subnet workloads. Here, the required behavior is to link the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution.

That approach lets an eligible peered spoke use a hub's VPN or ExpressRoute gateway; it does not replace Private DNS zone access for peered VNets for the constraint in this scenario.

This choice retains public service endpoint addressing while changing private subnet routing and service firewall identity. It leaves the specific need to extend selected Azure service routing and service identity from an approved VNet subnet unaddressed.

Although Service endpoint diagnostic separation checks source subnet configuration, resource firewall rules and actual service reachability, that is not sufficient to extend selected Azure service routing and service identity from an approved VNet subnet in this case.

Although Service endpoint unsupported-service review verifies whether the selected PaaS resource type supports service endpoints before planning access, that is not sufficient to extend selected Azure service routing and service identity from an approved VNet subnet in this case.

This choice configures supported backend protocol, port, host-name and session behavior. It leaves the specific need to modify a supported request or response header or URL before upstream routing unaddressed.

This alternative adjusts supported v2 gateway capacity automatically to demand within configured boundaries, which solves a different networking task. It does not directly modify a supported request or response header or URL before upstream routing.

That approach selects different backends based on URL path patterns; it does not replace Application Gateway URL rewrite rule for the constraint in this scenario.

This choice inspects web traffic at Microsoft's global edge before it reaches regional origins. It leaves the specific need to inspect HTTP/S requests at a regional application gateway using supported WAF policies unaddressed.

This alternative correlates WAF rule IDs, policy actions and client requests to investigate web filtering, which solves a different networking task. It does not directly inspect HTTP/S requests at a regional application gateway using supported WAF policies.

This alternative blocks HTTP requests that match configured WAF enforcement rules, which solves a different networking task. It does not directly inspect HTTP/S requests at a regional application gateway using supported WAF policies.

This choice checks origin availability from the edge to exclude unhealthy backends. It leaves the specific need to balance requests among equally prioritized healthy origins using configured weights unaddressed.

This choice selects healthy primary and secondary origins using configured priority and health. It leaves the specific need to balance requests among equally prioritized healthy origins using configured weights unaddressed.

Front Door end-to-end TLS protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings. The current problem instead requires a control that balances requests among equally prioritized healthy origins using configured weights.

This choice registers eligible VM DNS records automatically in a linked private DNS zone. It leaves the specific need to permit a selected VNet's resolver to query records in a private DNS zone unaddressed.

Custom DNS server settings on VNet directs VNet-resident clients to selected DNS servers for specialized resolution. The current problem instead requires a control that permits a selected VNet's resolver to query records in a private DNS zone.

Although Azure DNS public zone delegation hosts authoritative public DNS records under an internet-resolvable zone, that is not sufficient to permit a selected VNet's resolver to query records in a private DNS zone in this case.

Although Virtual WAN secure hub with Azure Firewall integrates managed central security inspection into a Virtual WAN virtual hub, that is not sufficient to deploy a Microsoft-managed regional hub for connectivity, routing and gateway services in this case.

This choice sizes a managed virtual-hub gateway for required bandwidth and connections. It leaves the specific need to deploy a Microsoft-managed regional hub for connectivity, routing and gateway services unaddressed.

Although Virtual WAN route propagation and labels defines which routes are advertised into selected hub route tables and connection groups, that is not sufficient to deploy a Microsoft-managed regional hub for connectivity, routing and gateway services in this case.

Private DNS zone access for peered VNets links the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution. The current problem instead requires a control that updates peering awareness after VNet address-space changes.

This alternative permits forwarded packets between peered VNets through a hub appliance where appropriate, which solves a different networking task. It does not directly update peering awareness after VNet address-space changes.

Azure Virtual Network Manager connectivity groups centrally coordinates VNet connectivity topology across many subscriptions. The current problem instead requires a control that updates peering awareness after VNet address-space changes.

This alternative attaches a workload VNet to a managed virtual hub for connectivity and route propagation, which solves a different networking task. It does not directly control which route table a hub connection uses for its forwarding decisions.

That approach deploys a supported third-party network virtual appliance in the managed hub solution; it does not replace Virtual WAN hub routing table association for the constraint in this scenario.

This alternative defines which routes are advertised into selected hub route tables and connection groups, which solves a different networking task. It does not directly control which route table a hub connection uses for its forwarding decisions.

That approach chooses between geographically distributed public endpoints through DNS responses; it does not replace Traffic Manager endpoint health monitoring for the constraint in this scenario.

That approach uses the current supported load balancer SKU with configurable health and security behavior; it does not replace Traffic Manager endpoint health monitoring for the constraint in this scenario.

Although Internal Load Balancer frontend exposes a private VNet IP address for a load-balanced service rather than a public endpoint, that is not sufficient to use endpoint status probes to determine which DNS endpoints remain eligible in this case.