Microsoft AZ-700 Bundle

VNet peering for private backbone connectivity connects two Azure virtual networks over the Microsoft backbone without a VPN appliance. The current problem instead requires a control that lets an eligible peered spoke use a hub's VPN or ExpressRoute gateway.

This alternative permits forwarded packets between peered VNets through a hub appliance where appropriate, which solves a different networking task. It does not directly let an eligible peered spoke use a hub's VPN or ExpressRoute gateway.

This alternative assigns supported public IP or public IP prefix resources to the gateway, which solves a different networking task. It does not directly let an eligible peered spoke use a hub's VPN or ExpressRoute gateway.

That approach stores DNS records visible through linked private-network resolution rather than public DNS; it does not replace Private DNS zone VNet link for the constraint in this scenario.

Custom DNS server settings on VNet directs VNet-resident clients to selected DNS servers for specialized resolution. The current problem instead requires a control that permits a selected VNet's resolver to query records in a private DNS zone.

Although Azure DNS public zone delegation hosts authoritative public DNS records under an internet-resolvable zone, that is not sufficient to permit a selected VNet's resolver to query records in a private DNS zone in this case.

This alternative selects supported capacity, metering and reach based on enterprise traffic needs, which solves a different networking task. It does not directly provide dedicated high-capacity direct ports at a supported peering location.

This choice provides private routing to VNet private address spaces over an ExpressRoute circuit. It leaves the specific need to provide dedicated high-capacity direct ports at a supported peering location unaddressed.

This alternative adds a supported encryption overlay when private circuit transport alone is insufficient, which solves a different networking task. It does not directly provide dedicated high-capacity direct ports at a supported peering location.

That approach groups VM interfaces by application role for NSG rule targeting; it does not replace Azure Bastion for browser-based VM administration for the constraint in this scenario.

This alternative governs supported high-priority security admin rules across centrally managed VNets, which solves a different networking task. It does not directly provide managed remote VM access without exposing RDP or SSH public IPs on each VM.

NSG remote management least privilege limits administrative connections to approved sources and ports rather than Internet-wide access. The current problem instead requires a control that provides managed remote VM access without exposing RDP or SSH public IPs on each VM.

Although P2S client address pool planning allocates remote-user tunnel addresses without overlapping VNet and on-premises ranges, that is not sufficient to provide encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel in this case.

P2S VPN client profile generation is useful when the goal is to deliver the correct gateway endpoints, routes and authentication settings to client devices. Here, the required behavior is to provide encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel.

P2S gateway SKU and concurrent-user limits sizes point-to-site connectivity for the expected simultaneous remote clients. The current problem instead requires a control that provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel.

Private Link service access visibility restricts eligible consumers through controlled visibility and approval settings. The current problem instead requires a control that gives authorized consumers a service alias to request private endpoints without using the full resource ID.

Although Private Link service provider design exposes a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link, that is not sufficient to give authorized consumers a service alias to request private endpoints without using the full resource ID in this case.

Private Endpoint DNS A-record integration maps the service's normal FQDN to its private endpoint IP address for authorized clients. The current problem instead requires a control that gives authorized consumers a service alias to request private endpoints without using the full resource ID.

Although Private IP allocation consistency across NICs ensures private addresses belong to the selected subnet and interface configuration, that is not sufficient to reserve a managed contiguous block of standard public addresses for public IP resources in this case.

That approach attaches the public IP to the correct network interface IP configuration; it does not replace Public IP Prefix for contiguous outbound allocation for the constraint in this scenario.

This choice assigns a routable public endpoint to a specified Azure resource when direct exposure is justified. It leaves the specific need to reserve a managed contiguous block of standard public addresses for public IP resources unaddressed.

Application Gateway custom health probe checks an application-specific path and expected response before including backends. The current problem instead requires a control that terminates client HTTPS on the gateway with the appropriate certificate and listener.

This alternative provides managed regional Layer 7 routing, TLS termination and web traffic distribution, which solves a different networking task. It does not directly terminate client HTTPS on the gateway with the appropriate certificate and listener.

That approach re-encrypts or retains HTTPS between the gateway and validated backend endpoints; it does not replace Application Gateway TLS termination for the constraint in this scenario.

Although NSG subnet association applies a network security group to all eligible network interfaces in a selected subnet, that is not sufficient to restrict workloads initiating network connections toward disallowed destinations in this case.

That approach restricts traffic entering a NIC or subnet by source, destination and service port; it does not replace NSG outbound rule destination and port for the constraint in this scenario.

Although ASG-based NSG access rule references application security groups as source or destination in supported NSG rules, that is not sufficient to restrict workloads initiating network connections toward disallowed destinations in this case.

This alternative restricts supported endpoint traffic from a subnet to specifically allowed Azure Storage resources, which solves a different networking task. It does not directly check source subnet configuration, resource firewall rules and actual service reachability.

PaaS resource firewall VNet rule is useful when the goal is to permit the specified subnet at the target managed service after a service endpoint is enabled. Here, the required behavior is to check source subnet configuration, resource firewall rules and actual service reachability.

Service endpoint public address distinction is useful when the goal is to retain public service endpoint addressing while changing private subnet routing and service firewall identity. Here, the required behavior is to check source subnet configuration, resource firewall rules and actual service reachability.

This alternative provides managed stateful network and application filtering without Premium-only inspection, which solves a different networking task. It does not directly deploy Azure Firewall into a supported Virtual WAN virtual hub for managed inspection.

Azure Firewall Manager for fleet governance manages and monitors multiple cloud firewalls and supported secure hubs centrally. The current problem instead requires a control that deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection.

Azure Firewall Policy across regions centralizes managed firewall settings and reusable rule collections. The current problem instead requires a control that deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection.