Pass Your Microsoft AZ-700 Exam Easy!

Two actions meet their requirements, but action 2 misses this need: weighted DNS routing can steer new resolver answers without providing layer-7 application transformations.

Two actions meet their requirements, but action 3 misses this need: a DNS traffic manager does not terminate HTTP/TLS connections or inspect request payloads.

Two actions meet their requirements, but action 1 misses this need: traffic Manager makes DNS-level routing decisions and is not an inline application proxy.

Here, front Door can apply supported request-routing transformations at the global entry point.

Adjusting Front Door caching behavior and implementing a controlled purge or cache-bypass path for freshness-sensitive responses would not configure Front Door rules sets and route options to apply the approved redirects and URL rewrites.

Deploying an appropriate Azure Front Door profile with routes, origin groups, endpoints, and health probes would not configure Front Door rules sets and route options to apply the approved redirects and URL rewrites.

A regional public IP does not automatically span independent regions or become a global frontend address.

This plan leaves out a required action: Check supported global or cross-region load-balancing constructs and separate regional address identities where required. The remaining action alone does not satisfy the situation.

Name resolution settings do not increase the number of assignable private addresses in a subnet.

This plan leaves out a required action: Evaluate ExpressRoute Global Reach between eligible circuits and validate location and provider support. The remaining action alone does not satisfy the situation.

Physical provider and peering diversity address failures that redundant gateway instances on one circuit cannot.

Global Reach joins supported on-premises sites through ExpressRoute circuits subject to geographic and SKU constraints.

Azure virtual network gateways rely on the specially named GatewaySubnet, not an arbitrary application segment.

This plan leaves out a required action: Expand or redesign the VNet address space and reserve appropriately sized nonoverlapping subnets before deploying new services. The remaining action alone does not satisfy the situation.

Subnet capacity and reserved addresses must be planned for service-specific requirements rather than consumed opportunistically.

Sticky routing can reduce session churn but cannot protect application sessions when a single backend permanently fails.

This plan leaves out a required action: Verify the supported Application Gateway frontend and backend protocol capabilities and match the origin application configuration. The remaining action alone does not satisfy the situation.

A gateway's client-facing protocol does not automatically imply identical protocol negotiation toward the backend.

Backend TLS validation depends on the expected name and chain, not just a responding TCP port.

Frontend TLS termination alone does not guarantee that the gateway-to-origin hop is encrypted.

This plan leaves out a required action: Configure HTTPS backend settings with appropriate certificate trust and end-to-end TLS validation. The remaining action alone does not satisfy the situation.

ExpressRoute uses private connectivity arrangements distinct from encrypted internet VPN tunnels.

This plan leaves out a required action: Design an ExpressRoute circuit with an eligible connectivity provider and appropriate peering and gateway configuration. The remaining action alone does not satisfy the situation.

Microsoft peering is not a substitute for Azure private peering to VNet private address space.

This plan leaves out a required action: Use Azure Firewall Policy hierarchy and appropriately scoped child policies with validation of rule collection priorities. The remaining action alone does not satisfy the situation.

A secured virtual hub has supported managed integration steps distinct from placing any VM in a peered subnet.

Central policy inheritance can standardize controls without copying every rule by hand into each firewall.

This plan leaves out a required action: Use supported Application Security Groups for member NICs and reference those groups in appropriate NSG rules. The remaining action alone does not satisfy the situation.

Subnet and NIC security rules can both affect traffic; one permissive policy does not override a deny elsewhere.

ASGs allow logically grouped network interfaces to be controlled without manually tracking each private address.

Application Gateway focuses on HTTP(S) services and does not expose generic TCP connections like an L4 balancer.

Frontend and backend ports are independent settings in an application-layer proxy.

This plan leaves out a required action: Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol. The remaining action alone does not satisfy the situation.