A. Incorrect.
Storing access keys in app settings keeps secrets in configuration and does not meet the secretless requirement.

B. Correct.
A managed identity lets Azure services authenticate to Key Vault without embedded credentials.

C. Incorrect.
Anonymous Key Vault access is not a secure or supported pattern for application secrets.

D. Incorrect.
A public IP prefix reserves IP addresses and does not authenticate to Key Vault.

A. Incorrect.
Static Web Apps hosts web content and APIs but is not specifically the queue-triggered serverless worker described.

B. Incorrect.
Azure DNS provides name resolution and does not execute queue-triggered code.

C. Correct.
Azure Functions can run serverless code in response to triggers such as queue messages.

D. Incorrect.
Policy initiatives govern resources and do not process queue messages.

A. Incorrect.
Blob lifecycle management changes blob tiers or deletes blobs and does not orchestrate functions.

B. Incorrect.
CDN rules affect edge content delivery and do not provide function orchestration.

C. Incorrect.
Private DNS resolver provides DNS resolution and does not manage workflow state.

D. Correct.
Durable Functions supports stateful orchestrations, activity functions, retries, and long-running workflows.

A. Correct.
Service Bus queues provide reliable brokered messaging where each message is processed by a single receiver.

B. Incorrect.
Event Grid is for event routing and fan-out, not ordered reliable queue processing by competing consumers.

C. Incorrect.
Front Door routes HTTP traffic and is not a message broker.

D. Incorrect.
App Configuration stores settings and feature flags, not queue messages.

A. Incorrect.
Azure Backup protects workloads and is not an event routing service.

B. Incorrect.
Azure Bastion provides secure VM access and does not route blob events.

C. Correct.
Event Grid routes events such as blob-created notifications to subscribers.

D. Incorrect.
An elastic pool manages SQL database resources and does not publish storage events.

A. Incorrect.
Service Bus sessions group related messages and do not manage blob tiers.

B. Incorrect.
App roles authorize application access and do not move blobs.

C. Incorrect.
Availability tests monitor endpoints and do not manage storage lifecycle.

D. Correct.
Storage lifecycle management can transition blobs between access tiers based on age and rules.

A. Incorrect.
Load Balancer distributes network traffic and does not store application settings.

B. Correct.
Azure App Configuration centralizes app settings and feature flags for distributed applications.

C. Incorrect.
Disk Encryption protects disks and does not manage feature flags.

D. Incorrect.
Cost Management budgets track spending and do not provide application configuration.

A. Correct.
OpenID Connect adds authentication and ID tokens on top of OAuth 2.0.

B. Incorrect.
SMB is a file sharing protocol and is not used for web sign-in tokens.

C. Incorrect.
BGP is a routing protocol and is unrelated to application authentication.

D. Incorrect.
TFTP is a simple file transfer protocol and does not provide modern web authentication.

A. Incorrect.
Service Health reports Azure service issues and does not cache application data.

B. Incorrect.
Private Link provides private network access and does not cache catalog data.

C. Correct.
Azure Cache for Redis stores frequently accessed data in memory to reduce latency and database load.

D. Incorrect.
An action group sends alerts or triggers actions and does not reduce data access latency.

A. Incorrect.
Table Storage is a NoSQL data store and does not host containerized APIs.

B. Incorrect.
A DNS zone can resolve names but does not run containers.

C. Incorrect.
Site Recovery is disaster recovery replication and does not host web APIs.

D. Correct.
Azure Container Apps hosts containerized applications with managed ingress and autoscaling without requiring cluster management.