A. Correct.
A Recovery Services vault is the logical container that stores backup data and recovery points for protected resources such as Azure VMs.

B. Incorrect.
A recovery plan is used with Azure Site Recovery orchestration, not as the first container for Azure Backup data.

C. Incorrect.
An availability set improves VM availability but does not store backups.

D. Incorrect.
A network security group controls traffic rules and has no role in storing backup recovery points.

A. Incorrect.
Subscriptions are management and billing boundaries; they do not by themselves minimize ports between application tiers.

B. Incorrect.
Public IPs on every VM increase exposure and do not help minimize tier-to-tier ports.

C. Correct.
A single VNet with separate subnets for each tier lets you use private IP communication and NSGs to restrict inter-tier ports.

D. Incorrect.
Storage accounts do not provide network segmentation for compute tiers.

A. Incorrect.
Opening HTTPS from the Internet to every tier violates least privilege and exposes internal tiers unnecessarily.

B. Correct.
Allow inbound TCP 443 from the Internet only to the web front-end subnet that users must reach.

C. Incorrect.
The database tier should not accept Internet HTTPS traffic for a public web app.

D. Incorrect.
Outbound processing rules do not allow inbound user access to the web front end.

A. Incorrect.
Storage account keys control storage access, not device join permissions.

B. Incorrect.
Azure Policy can govern Azure resource deployments, but device join controls are identity device settings.

C. Incorrect.
VNet DNS settings do not control who can join devices to Entra ID.

D. Correct.
Entra ID device settings control who may join devices and whether MFA is required for device join.

A. Incorrect.
Password hash synchronization stores password hashes in Microsoft Entra ID, which violates the requirement.

B. Correct.
Federation with AD FS lets authentication occur against on-premises identity infrastructure without storing password hashes in Azure AD.

C. Incorrect.
Cloud-only accounts do not provide hybrid SSO with the existing on-premises identities.

D. Incorrect.
SAS tokens provide delegated storage access and are unrelated to identity synchronization.

A. Incorrect.
Import/Export is useful for offline bulk data transfer using disks, not normal Internet upload with a desktop management tool.

B. Incorrect.
Traffic Manager performs DNS-based traffic routing and does not upload blobs.

C. Correct.
Azure Storage Explorer can upload, download, and manage Azure Blob Storage content over the Internet.

D. Incorrect.
AD Connect Health monitors identity synchronization health and does not manage blob files.

A. Incorrect.
Anonymous public access is not secure and does not provide time-limited controlled access.

B. Incorrect.
A new subscription does not grant temporary file access.

C. Incorrect.
A recovery point is backup data and does not grant partner access to blobs.

D. Correct.
A shared access signature grants scoped, time-limited access to storage resources without exposing the account key.

A. Correct.
Classic subscription administrator settings such as service administrator are changed from the subscription properties.

B. Incorrect.
VNet peerings configure network connectivity, not subscription administrator contacts.

C. Incorrect.
Storage containers manage blob data and access policies, not subscription administrators.

D. Incorrect.
NSG rules control network traffic and do not configure service administrator notifications.

A. Incorrect.
Storage account keys grant storage access and do not authorize network resource creation.

B. Correct.
Azure RBAC lets you assign least-privilege roles such as Network Contributor at the subscription or resource group scope.

C. Incorrect.
Backup policies control backup schedules and retention, not network permissions.

D. Incorrect.
A DNS label names a public IP endpoint and does not grant permissions.

A. Incorrect.
Hot is optimized for frequently accessed data and costs more for storage than archive.

B. Incorrect.
Cool is for infrequently accessed data but not the lowest-cost long-term tier.

C. Correct.
Archive is the lowest-cost Blob Storage tier for rarely accessed data that can tolerate rehydration latency.

D. Incorrect.
Premium page blobs are for high-performance disk scenarios, not lowest-cost archival file storage.