Microsoft AZ-700 Bundle

VPN client device deployment validation is useful when the goal is to validate supported OS, client version, tunnel profile and endpoint requirements. Here, the required behavior is to validate certificate-authenticated VPN clients against an uploaded trusted root.

This alternative authenticates supported VPN clients using the organization's Entra identity platform, which solves a different networking task. It does not directly validate certificate-authenticated VPN clients against an uploaded trusted root.

That approach uses an existing supported RADIUS server for VPN user authentication; it does not replace P2S root certificate trust configuration for the constraint in this scenario.

Static private NIC IP configuration is useful when the goal is to assign an intended stable private address to a VM network interface within its subnet. Here, the required behavior is to place security and routing policies on the workload subnet rather than assuming a public IP defines security.

Public IP Prefix for contiguous outbound allocation is useful when the goal is to reserve a managed contiguous block of standard public addresses for public IP resources. Here, the required behavior is to place security and routing policies on the workload subnet rather than assuming a public IP defines security.

This alternative attaches the public IP to the correct network interface IP configuration, which solves a different networking task. It does not directly place security and routing policies on the workload subnet rather than assuming a public IP defines security.

This alternative permits a selected VNet's resolver to query records in a private DNS zone, which solves a different networking task. It does not directly register eligible VM DNS records automatically in a linked private DNS zone.

That approach stores DNS records visible through linked private-network resolution rather than public DNS; it does not replace Private DNS zone auto-registration link for the constraint in this scenario.

DNS answer-path troubleshooting is useful when the goal is to test authoritative records, zone links and conditional forwarding in the proper order. Here, the required behavior is to register eligible VM DNS records automatically in a linked private DNS zone.

Network Watcher next hop is useful when the goal is to determine a VM's effective route and next-hop category to a destination. Here, the required behavior is to continuously track network reachability and performance between configured endpoints.

This alternative lists the combined network security rules effective on an Azure VM interface, which solves a different networking task. It does not directly continuously track network reachability and performance between configured endpoints.

Azure Monitor network resource metrics collects performance and health signals for Azure networking resources. The current problem instead requires a control that continuously tracks network reachability and performance between configured endpoints.

This choice terminates VPN connections from branches within the managed virtual hub. It leaves the specific need to define which routes are advertised into selected hub route tables and connection groups unaddressed.

Virtual WAN hub VNet connection attaches a workload VNet to a managed virtual hub for connectivity and route propagation. The current problem instead requires a control that defines which routes are advertised into selected hub route tables and connection groups.

Virtual WAN secure hub with Azure Firewall integrates managed central security inspection into a Virtual WAN virtual hub. The current problem instead requires a control that defines which routes are advertised into selected hub route tables and connection groups.

Application Gateway for regional HTTP routing is useful when the goal is to provide managed regional Layer 7 routing, TLS termination and web traffic distribution. Here, the required behavior is to re-encrypt or retains HTTPS between the gateway and validated backend endpoints.

This choice configures supported backend protocol, port, host-name and session behavior. It leaves the specific need to re-encrypt or retains HTTPS between the gateway and validated backend endpoints unaddressed.

This choice defines application servers, scale sets or FQDN destinations receiving proxied requests. It leaves the specific need to re-encrypt or retains HTTPS between the gateway and validated backend endpoints unaddressed.

This choice defines which routes are advertised into selected hub route tables and connection groups. It leaves the specific need to attache a workload VNet to a managed virtual hub for connectivity and route propagation unaddressed.

Although Standard Virtual WAN for advanced transit supports site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology, that is not sufficient to attache a workload VNet to a managed virtual hub for connectivity and route propagation in this case.

That approach deploys a Microsoft-managed regional hub for connectivity, routing and gateway services; it does not replace Virtual WAN hub VNet connection for the constraint in this scenario.

That approach uses multiple supported IP configurations on a network interface for distinct service addresses; it does not replace Public IP SKU and zone suitability for the constraint in this scenario.

NIC-level public IP association attaches the public IP to the correct network interface IP configuration. The current problem instead requires a control that selects the supported public IP SKU and zone behavior for the intended resource and region.

Although Standard Public IP for internet-facing VM assigns a routable public endpoint to a specified Azure resource when direct exposure is justified, that is not sufficient to select the supported public IP SKU and zone behavior for the intended resource and region in this case.

ASG-based NSG access rule is useful when the goal is to reference application security groups as source or destination in supported NSG rules. Here, the required behavior is to restrict workloads initiating network connections toward disallowed destinations.

NSG network interface association applies additional instance-specific NSG rules to a selected network interface. The current problem instead requires a control that restricts workloads initiating network connections toward disallowed destinations.

This alternative tests a specified source/destination/port and reports the allowing or blocking NSG rule, which solves a different networking task. It does not directly restrict workloads initiating network connections toward disallowed destinations.

This alternative checks identity, certificates and local profile logs before changing gateway routes, which solves a different networking task. It does not directly validate supported OS, client version, tunnel profile and endpoint requirements.

That approach chooses a supported SSL/TLS-based VPN client protocol for broad client compatibility; it does not replace VPN client device deployment validation for the constraint in this scenario.

This alternative provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel, which solves a different networking task. It does not directly validate supported OS, client version, tunnel profile and endpoint requirements.

This alternative groups VM interfaces by application role for NSG rule targeting, which solves a different networking task. It does not directly test a specified source/destination/port and reports the allowing or blocking NSG rule.

This choice restricts traffic entering a NIC or subnet by source, destination and service port. It leaves the specific need to test a specified source/destination/port and reports the allowing or blocking NSG rule unaddressed.

Although NSG outbound rule destination and port restricts workloads initiating network connections toward disallowed destinations, that is not sufficient to test a specified source/destination/port and reports the allowing or blocking NSG rule in this case.