A. Correct.
Business Critical provides synchronous replicas and supports zone redundant high availability where available.

B. Incorrect.
Basic does not provide the same HA architecture or zero-data-loss failover capabilities.

C. Incorrect.
Table Storage is a NoSQL store and not a relational SQL database tier.

D. Incorrect.
A single VM has no built-in zone-resilient database failover.

A. Incorrect.
Manual FTP copy does not provide no-downtime slot swapping.

B. Incorrect.
TXT records do not deploy application versions.

C. Correct.
Deployment slots allow staged deployments, warm-up, and swaps with production.

D. Incorrect.
Recovery Services vaults store backups and do not manage app release swaps.

A. Incorrect.
Azure Load Balancer is layer 4 and does not provide WAF or URL routing.

B. Correct.
Traffic Manager can route globally, while Application Gateway provides WAF, URL routing, and cookie-based affinity regionally.

C. Incorrect.
A storage firewall secures storage and does not load balance web apps.

D. Incorrect.
Private DNS does not provide WAF or active-active web routing.

A. Incorrect.
Public source control must not store secrets.

B. Incorrect.
DNS zones store records, not application secrets.

C. Incorrect.
Public containers expose data and are not appropriate for secrets.

D. Correct.
Azure Key Vault stores secrets, keys, and certificates securely for applications.

A. Incorrect.
A shared client secret violates the isolation requirement.

B. Correct.
Managed identities give Azure services their own identities without sharing credentials across services.

C. Incorrect.
Anonymous access is insecure and not credential isolation.

D. Incorrect.
Copying one storage key everywhere creates broad shared secret risk.

A. Incorrect.
Queues and Event Grid provide messaging and events, not SMB file shares.

B. Incorrect.
DNS and Traffic Manager route names and traffic, not file replication.

C. Correct.
Azure Files provides SMB file shares, and Azure File Sync can replicate/cache files to on-premises Windows servers.

D. Incorrect.
Key Vault and WAF secure secrets and web traffic, not SMB file storage.

A. Incorrect.
DNS logging does not trace app transactions.

B. Incorrect.
Lifecycle policies manage blob retention and tiers.

C. Incorrect.
Manual spreadsheets do not provide application telemetry.

D. Correct.
Application Insights can monitor requests, dependencies, and performance and supports no-code auto-instrumentation for supported App Service stacks.

A. Correct.
Azure Batch is designed for large-scale parallel and high-performance batch computing workloads.

B. Incorrect.
Azure DNS resolves names and does not run compute jobs.

C. Incorrect.
Private Link provides private access to services and does not schedule render tasks.

D. Incorrect.
Blueprints govern deployments but do not execute parallel rendering.

A. Incorrect.
Blob snapshots preserve object versions and do not review identities.

B. Correct.
Microsoft Entra access reviews help periodically review and remove guest access.

C. Incorrect.
DNS zone locks do not manage guest users.

D. Incorrect.
Rewrite rules modify HTTP headers or URLs and do not review access.

A. Incorrect.
Table Storage is a NoSQL store, not a microservices orchestration platform.

B. Incorrect.
Traffic Manager routes DNS traffic and does not host microservices.

C. Correct.
Service Fabric supports microservices, rolling upgrades, health policies, and deployments on Azure or on-premises.

D. Incorrect.
Azure Backup protects workloads and does not provide microservice runtime features.