Microsoft AZ-700 Bundle

This alternative provides managed stateful network and application filtering without Premium-only inspection, which solves a different networking task. It does not directly deploy Azure Firewall into a supported Virtual WAN virtual hub for managed inspection.

Azure Firewall Manager for fleet governance manages and monitors multiple cloud firewalls and supported secure hubs centrally. The current problem instead requires a control that deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection.

Azure Firewall Policy across regions centralizes managed firewall settings and reusable rule collections. The current problem instead requires a control that deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection.

This choice uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. It leaves the specific need to update endpoint connections, DNS and service firewall settings together during a resource move unaddressed.

Private DNS zone group on private endpoint is useful when the goal is to integrate an endpoint with the appropriate private DNS zone records where supported. Here, the required behavior is to update endpoint connections, DNS and service firewall settings together during a resource move.

Private Endpoint approval workflow is useful when the goal is to require the service owner to authorize pending private endpoint connections when necessary. Here, the required behavior is to update endpoint connections, DNS and service firewall settings together during a resource move.

This choice continuously tracks network reachability and performance between configured endpoints. It leaves the specific need to add managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses unaddressed.

Azure diagnostic settings to Log Analytics sends supported network resource logs to a workspace for query and retention. The current problem instead requires a control that adds managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses.

Although Network Watcher effective security rules lists the combined network security rules effective on an Azure VM interface, that is not sufficient to add managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses in this case.

This alternative applies a network security group to all eligible network interfaces in a selected subnet, which solves a different networking task. It does not directly provide managed remote VM access without exposing RDP or SSH public IPs on each VM.

Although NSG remote management least privilege limits administrative connections to approved sources and ports rather than Internet-wide access, that is not sufficient to provide managed remote VM access without exposing RDP or SSH public IPs on each VM in this case.

This alternative groups VM interfaces by application role for NSG rule targeting, which solves a different networking task. It does not directly provide managed remote VM access without exposing RDP or SSH public IPs on each VM.

Local network gateway configuration records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. The current problem instead requires a control that provisions the Azure-managed VPN gateway attached to the target VNet.

This alternative selects a supported VPN gateway tier sized for aggregate tunnels and traffic, which solves a different networking task. It does not directly provision the Azure-managed VPN gateway attached to the target VNet.

Although Active-active VPN gateway design uses multiple gateway instances and connections for supported VPN link resiliency, that is not sufficient to provision the Azure-managed VPN gateway attached to the target VNet in this case.

That approach collects performance and health signals for Azure networking resources; it does not replace Azure diagnostic settings to Log Analytics for the constraint in this scenario.

Azure DDoS Protection deployment adds managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses. The current problem instead requires a control that sends supported network resource logs to a workspace for query and retention.

Although Network Watcher packet capture captures scoped packet evidence from a supported VM for protocol troubleshooting, that is not sufficient to send supported network resource logs to a workspace for query and retention in this case.

Although Service endpoint policy subnet binding associates an approved service endpoint policy with the intended endpoint-enabled workload subnet, that is not sufficient to check source subnet configuration, resource firewall rules and actual service reachability in this case.

Although Service endpoint public address distinction retains public service endpoint addressing while changing private subnet routing and service firewall identity, that is not sufficient to check source subnet configuration, resource firewall rules and actual service reachability in this case.

This alternative verifies whether the selected PaaS resource type supports service endpoints before planning access, which solves a different networking task. It does not directly check source subnet configuration, resource firewall rules and actual service reachability.

A service alias can identify the service to a consumer, but distribution of an alias is not the provider-side subscription visibility eligibility setting.

Approving a pending Private Endpoint request happens after a consumer can make the request; it is distinct from setting eligible subscriptions.

Authorizing a specific endpoint/resource connection is a later instance-level access decision, not the subscription visibility list.

This alternative selects the intended backend network interfaces or IPs that receive distributed traffic, which solves a different networking task. It does not directly define a frontend protocol/port and backend pool mapping for distributed connections.

That approach controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend; it does not replace Load Balancer load-balancing rule for the constraint in this scenario.

Although Cross-region Azure Load Balancer design uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency, that is not sufficient to define a frontend protocol/port and backend pool mapping for distributed connections in this case.

NAT Gateway subnet association applies a NAT Gateway's outbound SNAT behavior to a selected subnet. The current problem instead requires a control that applies a defined user route collection to the workload subnet.

Azure Route Server for BGP exchange exchanges dynamic routes with supported network virtual appliances over BGP. The current problem instead requires a control that applies a defined user route collection to the workload subnet.

Although Effective routes and next-hop diagnosis reveals which system, BGP or user route determines an actual VM next hop, that is not sufficient to apply a defined user route collection to the workload subnet in this case.

That approach accounts for Azure-reserved addresses and workload growth in each subnet; it does not replace GatewaySubnet for virtual network gateway for the constraint in this scenario.

Subnet network policy placement places security and routing policies on the workload subnet rather than assuming a public IP defines security. The current problem instead requires a control that allocates the reserved gateway subnet used by Azure VPN or ExpressRoute gateways.

Static private NIC IP configuration assigns an intended stable private address to a VM network interface within its subnet. The current problem instead requires a control that allocates the reserved gateway subnet used by Azure VPN or ExpressRoute gateways.