Microsoft AZ-700 Bundle

This alternative applies FQDN- or application-aware outbound access controls for supported protocols, which solves a different networking task. It does not directly provide centrally proxied DNS resolution for supported FQDN-based network policy.

Although Azure Firewall Standard for stateful filtering provides managed stateful network and application filtering without Premium-only inspection, that is not sufficient to provide centrally proxied DNS resolution for supported FQDN-based network policy in this case.

This choice manages and monitors multiple cloud firewalls and supported secure hubs centrally. It leaves the specific need to provide centrally proxied DNS resolution for supported FQDN-based network policy unaddressed.

That approach supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device; it does not replace Policy-based traffic-selector compatibility for the constraint in this scenario.

That approach updates peer and local network gateway settings together during a branch cutover; it does not replace Policy-based traffic-selector compatibility for the constraint in this scenario.

Although VPN gateway SKU throughput planning selects a supported VPN gateway tier sized for aggregate tunnels and traffic, that is not sufficient to handle a restricted legacy VPN peer that relies on specific address selectors in this case.

Although Cross-region Azure Load Balancer design uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency, that is not sufficient to use endpoint status probes to determine which DNS endpoints remain eligible in this case.

Although Load Balancer health probe tests a configured probe endpoint or port to determine eligible healthy backends, that is not sufficient to use endpoint status probes to determine which DNS endpoints remain eligible in this case.

This alternative chooses between geographically distributed public endpoints through DNS responses, which solves a different networking task. It does not directly use endpoint status probes to determine which DNS endpoints remain eligible.

This alternative integrates managed central security inspection into a Virtual WAN virtual hub, which solves a different networking task. It does not directly define which routes are advertised into selected hub route tables and connection groups.

This alternative controls which route table a hub connection uses for its forwarding decisions, which solves a different networking task. It does not directly define which routes are advertised into selected hub route tables and connection groups.

This choice terminates VPN connections from branches within the managed virtual hub. It leaves the specific need to define which routes are advertised into selected hub route tables and connection groups unaddressed.

Although Application Gateway for regional HTTP routing provides managed regional Layer 7 routing, TLS termination and web traffic distribution, that is not sufficient to terminate client HTTPS on the gateway with the appropriate certificate and listener in this case.

Application Gateway HTTP listener matches incoming protocol, port and optional host name before routing requests. The current problem instead requires a control that terminates client HTTPS on the gateway with the appropriate certificate and listener.

This choice adjusts supported v2 gateway capacity automatically to demand within configured boundaries. It leaves the specific need to terminate client HTTPS on the gateway with the appropriate certificate and listener unaddressed.

Although Private Endpoint DNS A-record integration maps the service's normal FQDN to its private endpoint IP address for authorized clients, that is not sufficient to integrate an endpoint with the appropriate private DNS zone records where supported in this case.

Although Private Endpoint migration cutover updates endpoint connections, DNS and service firewall settings together during a resource move, that is not sufficient to integrate an endpoint with the appropriate private DNS zone records where supported in this case.

This alternative confirms peering, DNS zone links and security policies for clients in another VNet, which solves a different networking task. It does not directly integrate an endpoint with the appropriate private DNS zone records where supported.

NSG outbound rule destination and port is useful when the goal is to restrict workloads initiating network connections toward disallowed destinations. Here, the required behavior is to limit administrative connections to approved sources and ports rather than Internet-wide access.

Azure Bastion for browser-based VM administration is useful when the goal is to provide managed remote VM access without exposing RDP or SSH public IPs on each VM. Here, the required behavior is to limit administrative connections to approved sources and ports rather than Internet-wide access.

This alternative applies a network security group to all eligible network interfaces in a selected subnet, which solves a different networking task. It does not directly limit administrative connections to approved sources and ports rather than Internet-wide access.

IPsec/IKE policy interoperability is useful when the goal is to align matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device. Here, the required behavior is to inspect tunnel state, negotiated parameters and gateway logs before changing routes.

Although VPN gateway SKU throughput planning selects a supported VPN gateway tier sized for aggregate tunnels and traffic, that is not sufficient to inspect tunnel state, negotiated parameters and gateway logs before changing routes in this case.

S2S reachability verification beyond tunnel state is useful when the goal is to validate routing, NSGs and return paths after IPsec reports connected. Here, the required behavior is to inspect tunnel state, negotiated parameters and gateway logs before changing routes.

Microsoft Entra ID P2S authentication authenticates supported VPN clients using the organization's Entra identity platform. The current problem instead requires a control that uses an existing supported RADIUS server for VPN user authentication.

This choice delivers the correct gateway endpoints, routes and authentication settings to client devices. It leaves the specific need to use an existing supported RADIUS server for VPN user authentication unaddressed.

That approach validates supported OS, client version, tunnel profile and endpoint requirements; it does not replace RADIUS authentication for P2S VPN for the constraint in this scenario.

This choice configures supported backend protocol, port, host-name and session behavior. It leaves the specific need to define application servers, scale sets or FQDN destinations receiving proxied requests unaddressed.

That approach checks an application-specific path and expected response before including backends; it does not replace Application Gateway backend pool for the constraint in this scenario.

This alternative re-encrypts or retains HTTPS between the gateway and validated backend endpoints, which solves a different networking task. It does not directly define application servers, scale sets or FQDN destinations receiving proxied requests.

This choice updates endpoint connections, DNS and service firewall settings together during a resource move. It leaves the specific need to restrict eligible consumers through controlled visibility and approval settings unaddressed.

Private Link service provider design exposes a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link. The current problem instead requires a control that restricts eligible consumers through controlled visibility and approval settings.

That approach gives authorized consumers a service alias to request private endpoints without using the full resource ID; it does not replace Private Link service access visibility for the constraint in this scenario.