A. Correct.
A custom RBAC role should include the required managed disk operations and be scoped only where the delegation is needed.

B. Incorrect.
Global Administrator is an Entra role and is far broader than required for disk administration.

C. Incorrect.
A SAS token grants storage access and does not delegate Azure managed disk operations.

D. Incorrect.
Reader cannot manage disks and subscription root scope is not least privilege.

A. Incorrect.
File integrity monitoring detects file changes but does not open temporary management ports.

B. Incorrect.
DNS forwarding controls name resolution and does not govern VM management access.

C. Correct.
JIT VM access locks down management ports and opens them temporarily after approval.

D. Incorrect.
Blob soft delete protects deleted blobs and is unrelated to VM access.

A. Incorrect.
Firewall threat intelligence affects network filtering, not user app registration or consent.

B. Correct.
Microsoft Entra ID exposes controls for who can register applications and whether users can consent to applications.

C. Incorrect.
Lifecycle management affects blobs and has no identity consent function.

D. Incorrect.
Connection monitor tests network reachability and does not control app consent.

A. Incorrect.
Anonymous access is unrelated and would weaken security.

B. Incorrect.
Storage metrics do not protect privileged role activation.

C. Incorrect.
Route tables do not satisfy PIM activation security requirements.

D. Correct.
PIM commonly requires MFA for activation of privileged roles and helps enforce just-in-time administration.

A. Incorrect.
Azure DNS does not provide security posture customization.

B. Correct.
Advanced Defender for Cloud capabilities are needed for richer policy, assessment, and workload protection scenarios.

C. Incorrect.
A public IP prefix reserves addresses and does not enable Defender capabilities.

D. Incorrect.
Azure Files soft delete protects file shares but does not customize OS security recommendations.

A. Incorrect.
App Configuration stores application settings and feature flags, not encryption keys for storage.

B. Incorrect.
Front Door routes HTTP/S traffic and does not store encryption keys.

C. Correct.
Azure Key Vault can store customer-managed keys used by Azure Storage encryption.

D. Incorrect.
Traffic Manager performs DNS-based routing and does not manage storage encryption keys.

A. Incorrect.
A public container would expose storage content and does not protect Key Vault traffic.

B. Incorrect.
Service tags simplify network rules but do not provide private Key Vault connectivity by themselves.

C. Incorrect.
A CDN endpoint accelerates content and is not used for private Key Vault access.

D. Correct.
A private endpoint allows private access to Key Vault over the Microsoft backbone.

A. Correct.
WAF custom rules can match request attributes such as geography and take allow or block actions.

B. Incorrect.
A delete lock protects resources from deletion and does not filter web requests.

C. Incorrect.
Azure Files provides file shares and is unrelated to WAF request filtering.

D. Incorrect.
A saved query can help analysis but does not block traffic.

A. Incorrect.
Owner grants full management and access control permissions, which is excessive.

B. Correct.
AcrPull allows pulling images from Azure Container Registry without push or administrative permissions.

C. Incorrect.
AcrPush can push and pull images, which is more than the AKS identity requires.

D. Incorrect.
User Access Administrator manages role assignments and is not needed for pulling images.

A. Incorrect.
Action groups send alert notifications and do not browse storage diagnostics tables.

B. Incorrect.
SSMS is for SQL Server and Azure SQL, not Azure Storage diagnostics table browsing.

C. Correct.
Azure Storage Explorer can browse storage account data, including diagnostics-related tables where available.

D. Incorrect.
Azure Bastion provides secure VM remote access and does not inspect storage logs.