Microsoft AZ-700 Bundle

This alternative groups VM interfaces by application role for NSG rule targeting, which solves a different networking task. It does not directly test a specified source/destination/port and reports the allowing or blocking NSG rule.

This choice restricts traffic entering a NIC or subnet by source, destination and service port. It leaves the specific need to test a specified source/destination/port and reports the allowing or blocking NSG rule unaddressed.

Although NSG outbound rule destination and port restricts workloads initiating network connections toward disallowed destinations, that is not sufficient to test a specified source/destination/port and reports the allowing or blocking NSG rule in this case.

This alternative deploys a supported private endpoint NIC in the correct consumer VNet subnet, which solves a different networking task. It does not directly apply enabled private endpoint network policies when traffic inspection or subnet filtering is needed.

Network-level connectivity prerequisite for remote Private Endpoints is useful when the goal is to require appropriate VPN, ExpressRoute or peering connectivity before remote networks can route to a private endpoint IP. Here, the required behavior is to apply enabled private endpoint network policies when traffic inspection or subnet filtering is needed.

Although Private Endpoint approval workflow requires the service owner to authorize pending private endpoint connections when necessary, that is not sufficient to apply enabled private endpoint network policies when traffic inspection or subnet filtering is needed in this case.

P2S VPN client profile generation is useful when the goal is to deliver the correct gateway endpoints, routes and authentication settings to client devices. Here, the required behavior is to size point-to-site connectivity for the expected simultaneous remote clients.

That approach advertises or includes the correct private destination prefixes in remote-user VPN profiles; it does not replace P2S gateway SKU and concurrent-user limits for the constraint in this scenario.

That approach provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel; it does not replace P2S gateway SKU and concurrent-user limits for the constraint in this scenario.

GatewaySubnet for virtual network gateway is useful when the goal is to allocate the reserved gateway subnet used by Azure VPN or ExpressRoute gateways. Here, the required behavior is to provide the reserved firewall subnet for the managed Azure Firewall deployment.

This alternative tracks CIDR ownership, free space and subnet relationships before deployment, which solves a different networking task. It does not directly provide the reserved firewall subnet for the managed Azure Firewall deployment.

That approach reserves the specifically named subnet required for Azure Bastion; it does not replace AzureFirewallSubnet sizing for the constraint in this scenario.

Azure Front Door global application delivery provides globally distributed edge entry points with accelerated HTTP/S routing to origins. The current problem instead requires a control that balances requests among equally prioritized healthy origins using configured weights.

Front Door Private Link to supported origin connects an eligible Front Door Premium origin privately without exposing it broadly. The current problem instead requires a control that balances requests among equally prioritized healthy origins using configured weights.

Although Front Door origin group priority failover selects healthy primary and secondary origins using configured priority and health, that is not sufficient to balance requests among equally prioritized healthy origins using configured weights in this case.

PaaS resource firewall VNet rule is useful when the goal is to permit the specified subnet at the target managed service after a service endpoint is enabled. Here, the required behavior is to associate an approved service endpoint policy with the intended endpoint-enabled workload subnet.

This choice restricts supported endpoint traffic from a subnet to specifically allowed Azure Storage resources. It leaves the specific need to associate an approved service endpoint policy with the intended endpoint-enabled workload subnet unaddressed.

This alternative uses an approved private endpoint with hybrid DNS and VPN/ExpressRoute reachability when on-premises clients require private PaaS access, which solves a different networking task. It does not directly associate an approved service endpoint policy with the intended endpoint-enabled workload subnet.

Subnet delegation for PaaS integration delegates a subnet to a supported service so the platform can manage its integration requirements. The current problem instead requires a control that provides the reserved firewall subnet for the managed Azure Firewall deployment.

Although Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet, that is not sufficient to provide the reserved firewall subnet for the managed Azure Firewall deployment in this case.

This choice tracks CIDR ownership, free space and subnet relationships before deployment. It leaves the specific need to provide the reserved firewall subnet for the managed Azure Firewall deployment unaddressed.

That approach determines a VM's effective route and next-hop category to a destination; it does not replace Network Watcher effective security rules for the constraint in this scenario.

Cloud Security Explorer asset queries searches security and resource context to find network assets matching risk conditions. The current problem instead requires a control that lists the combined network security rules effective on an Azure VM interface.

This alternative identifies an NSG rule that allows or denies a specified VM traffic flow, which solves a different networking task. It does not directly list the combined network security rules effective on an Azure VM interface.

That approach confirms private service FQDNs resolve to the intended private endpoint addresses; it does not replace Azure DNS Private Resolver inbound endpoint for the constraint in this scenario.

Although Azure-provided DNS for VNet hostnames resolves supported internal hostnames using default Azure DNS within a VNet, that is not sufficient to accept DNS queries arriving from on-premises or connected networks into Azure resolution in this case.

This choice stores DNS records visible through linked private-network resolution rather than public DNS. It leaves the specific need to accept DNS queries arriving from on-premises or connected networks into Azure resolution unaddressed.

This choice confirms private service FQDNs resolve to the intended private endpoint addresses. It leaves the specific need to register eligible VM DNS records automatically in a linked private DNS zone unaddressed.

Azure private DNS zone stores DNS records visible through linked private-network resolution rather than public DNS. The current problem instead requires a control that registers eligible VM DNS records automatically in a linked private DNS zone.

Although Azure DNS public zone delegation hosts authoritative public DNS records under an internet-resolvable zone, that is not sufficient to register eligible VM DNS records automatically in a linked private DNS zone in this case.

That approach exposes a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link; it does not replace Private Link service alias distribution for the constraint in this scenario.

This alternative requires appropriate VPN, ExpressRoute or peering connectivity before remote networks can route to a private endpoint IP, which solves a different networking task. It does not directly give authorized consumers a service alias to request private endpoints without using the full resource ID.

This alternative scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions, which solves a different networking task. It does not directly give authorized consumers a service alias to request private endpoints without using the full resource ID.