A. Incorrect.
DNS private resolver provides name resolution and does not collect VM telemetry.

B. Correct.
The Azure VM diagnostics extension collects guest OS diagnostics such as event logs and performance counters.

C. Incorrect.
Storage lifecycle management moves or deletes blobs based on rules and does not collect VM logs.

D. Incorrect.
Traffic Manager routes DNS traffic across endpoints and does not gather VM diagnostics.

A. Incorrect.
A public IP prefix reserves public addresses and does not store or query logs.

B. Incorrect.
A proximity placement group influences physical VM placement and does not provide log queries.

C. Correct.
Log Analytics workspaces store Azure Monitor logs and support KQL queries.

D. Incorrect.
A storage queue stores application messages and is not the Azure Monitor log query workspace.

A. Incorrect.
Blob soft delete helps recover deleted blobs and does not notify about service outages.

B. Incorrect.
Firewall DNAT rules translate inbound network traffic and do not provide service health notifications.

C. Incorrect.
Storage Explorer manages storage resources and does not send Azure service health alerts.

D. Correct.
Azure Service Health alerts notify you about service issues, planned maintenance, and health advisories affecting your resources.

A. Correct.
Reader can view resources without making changes.

B. Incorrect.
Owner can manage resources and access, which is more permission than required.

C. Incorrect.
Contributor can create and modify resources, so it violates the read-only requirement.

D. Incorrect.
User Access Administrator manages role assignments and is not a read-only role.

A. Incorrect.
A public IP address exposes network connectivity and does not protect against deletion.

B. Incorrect.
A NAT gateway provides outbound Internet connectivity and does not prevent deletion.

C. Correct.
A delete lock prevents deletion at the applied scope while still allowing permitted read and update operations.

D. Incorrect.
A route table controls traffic routing and is not a governance lock.

A. Incorrect.
Traffic Manager is DNS-based endpoint routing and does not provide secure VM administration sessions.

B. Incorrect.
CDN caches static content and does not provide VM remote access.

C. Incorrect.
Table Storage stores NoSQL structured data and has no VM remote access function.

D. Correct.
Azure Bastion provides secure RDP and SSH connectivity through the Azure portal without public RDP/SSH exposure.

A. Incorrect.
Service Bus provides messaging, not network load balancing.

B. Correct.
Azure Load Balancer distributes layer 4 TCP and UDP traffic across backend resources such as VMs.

C. Incorrect.
Azure Policy enforces governance rules and does not distribute traffic.

D. Incorrect.
Key Vault stores secrets, keys, and certificates and is not a load balancer.

A. Correct.
Azure File Sync, configured through Storage Sync Service, synchronizes on-premises file servers with Azure Files and supports cloud tiering.

B. Incorrect.
Queue Storage stores messages and does not sync file shares.

C. Incorrect.
Notification Hubs sends push notifications to devices and does not sync files.

D. Incorrect.
App Configuration centralizes application settings and does not synchronize file servers.

A. Incorrect.
A DNS CNAME alone does not provide private network connectivity.

B. Incorrect.
An availability set improves VM placement availability and does not affect storage network access.

C. Correct.
Service endpoints and private endpoints are common ways to provide private network access from VNets to Azure Storage.

D. Incorrect.
A Recovery Services vault stores backup data and does not provide private storage connectivity.

A. Incorrect.
Blob inventory reports blob metadata and is unrelated to VM network troubleshooting.

B. Incorrect.
Access reviews evaluate identity access and do not test network traffic.

C. Incorrect.
Cost alerts notify about spending and do not diagnose VM connectivity.

D. Correct.
IP flow verify checks whether traffic is allowed or denied to or from a VM based on security rules.