Microsoft AZ-700 Bundle

This choice controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend. It leaves the specific need to use supported regional frontends beneath a global load balancing layer for L4 regional resiliency unaddressed.

That approach defines a frontend protocol/port and backend pool mapping for distributed connections; it does not replace Cross-region Azure Load Balancer design for the constraint in this scenario.

This choice distributes TCP or UDP flows to healthy backend instances in an Azure region. It leaves the specific need to use supported regional frontends beneath a global load balancing layer for L4 regional resiliency unaddressed.

This choice validates supported OS, client version, tunnel profile and endpoint requirements. It leaves the specific need to validate certificate-authenticated VPN clients against an uploaded trusted root unaddressed.

Microsoft Entra ID P2S authentication is useful when the goal is to authenticate supported VPN clients using the organization's Entra identity platform. Here, the required behavior is to validate certificate-authenticated VPN clients against an uploaded trusted root.

Although P2S VPN client profile generation delivers the correct gateway endpoints, routes and authentication settings to client devices, that is not sufficient to validate certificate-authenticated VPN clients against an uploaded trusted root in this case.

This choice adds a supported encryption overlay when private circuit transport alone is insufficient. It leaves the specific need to create the provider-backed private connectivity circuit before linking Azure VNets unaddressed.

This alternative provides private routing to VNet private address spaces over an ExpressRoute circuit, which solves a different networking task. It does not directly create the provider-backed private connectivity circuit before linking Azure VNets.

This choice checks provider provisioning, BGP state and Azure connection health before making changes. It leaves the specific need to create the provider-backed private connectivity circuit before linking Azure VNets unaddressed.

This alternative logs matching malicious patterns without blocking legitimate traffic during a controlled baseline, which solves a different networking task. It does not directly narrow a proven harmless match while retaining the remainder of managed protections.

This choice uses a supported managed web attack signature rule set for common application threats. It leaves the specific need to narrow a proven harmless match while retaining the remainder of managed protections unaddressed.

This choice correlates WAF rule IDs, policy actions and client requests to investigate web filtering. It leaves the specific need to narrow a proven harmless match while retaining the remainder of managed protections unaddressed.

This alternative connects an eligible Front Door Premium origin privately without exposing it broadly, which solves a different networking task. It does not directly check origin availability from the edge to exclude unhealthy backends.

Although Front Door WAF policy association applies supported application-layer rules at the globally distributed edge, that is not sufficient to check origin availability from the edge to exclude unhealthy backends in this case.

Front Door origin group priority failover is useful when the goal is to select healthy primary and secondary origins using configured priority and health. Here, the required behavior is to check origin availability from the edge to exclude unhealthy backends.

Although Standard Load Balancer for modern workloads uses the current supported load balancer SKU with configurable health and security behavior, that is not sufficient to provide an Internet-routable Layer 4 frontend for approved external clients in this case.

Load Balancer load-balancing rule is useful when the goal is to define a frontend protocol/port and backend pool mapping for distributed connections. Here, the required behavior is to provide an Internet-routable Layer 4 frontend for approved external clients.

This alternative exposes a private VNet IP address for a load-balanced service rather than a public endpoint, which solves a different networking task. It does not directly provide an Internet-routable Layer 4 frontend for approved external clients.

Effective routes and next-hop diagnosis is useful when the goal is to reveal which system, BGP or user route determines an actual VM next hop. Here, the required behavior is to direct selected subnet traffic to a nominated next-hop NVA address.

This alternative updates peering awareness after VNet address-space changes, which solves a different networking task. It does not directly direct selected subnet traffic to a nominated next-hop NVA address.

Although Route table association to subnet applies a defined user route collection to the workload subnet, that is not sufficient to direct selected subnet traffic to a nominated next-hop NVA address in this case.

This choice configures supported backend protocol, port, host-name and session behavior. It leaves the specific need to use host-based listeners to select application backends for different domain names unaddressed.

That approach matches incoming protocol, port and optional host name before routing requests; it does not replace Application Gateway multi-site routing for the constraint in this scenario.

Although Application Gateway custom health probe checks an application-specific path and expected response before including backends, that is not sufficient to use host-based listeners to select application backends for different domain names in this case.

Although WAF diagnostic logging and investigation correlates WAF rule IDs, policy actions and client requests to investigate web filtering, that is not sufficient to inspect web traffic at Microsoft's global edge before it reaches regional origins in this case.

This alternative logs matching malicious patterns without blocking legitimate traffic during a controlled baseline, which solves a different networking task. It does not directly inspect web traffic at Microsoft's global edge before it reaches regional origins.

WAF policy association to listener or domain binds the WAF policy to the supported application gateway listener or edge domain. The current problem instead requires a control that inspects web traffic at Microsoft's global edge before it reaches regional origins.

This choice connects an eligible Front Door Premium origin privately without exposing it broadly. It leaves the specific need to cache eligible static web responses at the global edge under explicit policy unaddressed.

That approach protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings; it does not replace Front Door caching configuration for the constraint in this scenario.

This alternative provides globally distributed edge entry points with accelerated HTTP/S routing to origins, which solves a different networking task. It does not directly cache eligible static web responses at the global edge under explicit policy.

This alternative applies FQDN- or application-aware outbound access controls for supported protocols, which solves a different networking task. It does not directly provide centrally proxied DNS resolution for supported FQDN-based network policy.

Although Azure Firewall Standard for stateful filtering provides managed stateful network and application filtering without Premium-only inspection, that is not sufficient to provide centrally proxied DNS resolution for supported FQDN-based network policy in this case.

This choice manages and monitors multiple cloud firewalls and supported secure hubs centrally. It leaves the specific need to provide centrally proxied DNS resolution for supported FQDN-based network policy unaddressed.