A. Incorrect.
A single-region App Service plan does not provide regional failure resiliency and does not provide OS-level installation control.

B. Correct.
Virtual machines provide OS-level control and full framework support, while multi-region deployment with global routing supports regional resiliency.

C. Incorrect.
Functions do not provide the same OS-level administrative control for installing custom dependencies.

D. Incorrect.
Static website hosting cannot run a full .NET Framework application or custom OS dependencies.

A. Incorrect.
DNS records affect name resolution, not IP routing through a network appliance.

B. Incorrect.
Front Door handles global HTTP/S entry traffic and does not force all subnet traffic through an appliance.

C. Correct.
User-defined routes can direct subnet traffic to a virtual appliance as the next hop.

D. Incorrect.
Availability sets improve VM availability inside a datacenter region but do not control routing.

A. Incorrect.
Application Gateway is a layer 7 load balancer and web application delivery service, not private WAN connectivity.

B. Incorrect.
Bastion provides secure RDP/SSH access to VMs through the Azure portal.

C. Incorrect.
CDN caches content at edge locations and does not provide private enterprise connectivity.

D. Correct.
ExpressRoute extends on-premises networks into Microsoft cloud over private connectivity through a provider.

A. Correct.
For periodic users, a usage-based MFA approach can reduce cost compared with permanently licensing every contractor.

B. Incorrect.
Permanent high-tier licenses for intermittent contractors can be more expensive than necessary.

C. Incorrect.
Disabling MFA fails the security requirement.

D. Incorrect.
Network security groups filter network traffic and cannot enforce identity MFA.

A. Incorrect.
Load Balancer distributes network traffic and does not orchestrate data pipelines.

B. Incorrect.
Notification Hubs sends push notifications and is unrelated to data lake transformations.

C. Correct.
Azure Data Factory is built for data integration, orchestration, pipelines, copy activities, and mapping data flows.

D. Incorrect.
AD Connect Health monitors identity synchronization health, not data movement.

A. Incorrect.
Storage Sync synchronizes file shares with Azure Files, not identities.

B. Incorrect.
Traffic Manager routes DNS traffic and has no identity synchronization role.

C. Incorrect.
Data Box Gateway transfers data to Azure Storage and does not synchronize directory identities.

D. Correct.
Microsoft Entra Connect synchronizes identities from on-premises Active Directory to Microsoft Entra ID and supports SSO scenarios.

A. Incorrect.
Azure DNS hosts DNS records and is not a log analytics store.

B. Correct.
A Log Analytics workspace stores Azure Monitor logs and supports querying with KQL.

C. Incorrect.
CDN caches content and does not provide log query workspace capabilities.

D. Incorrect.
Azure Blueprints packages governance artifacts; it is not a log query platform.

A. Correct.
Azure Service Bus provides enterprise messaging features such as topics, subscriptions, sessions, duplicate detection, and dead-lettering.

B. Incorrect.
Blob lifecycle management moves or deletes objects by policy and is not a message broker.

C. Incorrect.
Azure Backup protects data and workloads but does not provide application messaging.

D. Incorrect.
Private DNS provides name resolution inside virtual networks, not message brokering.

A. Incorrect.
Recovery time objective is the maximum acceptable time to restore service after an outage.

B. Incorrect.
A service endpoint extends private address space access to Azure services and is not a DR metric.

C. Correct.
Recovery point objective is the maximum acceptable data loss window, measured as a point in time.

D. Incorrect.
A fault domain is a physical failure boundary, not a data loss metric.

A. Incorrect.
A public IP address exposes a network endpoint and is not a deletion protection control.

B. Incorrect.
A proximity placement group influences VM placement latency and does not prevent deletion.

C. Incorrect.
A CDN endpoint accelerates content delivery and does not protect resources from deletion.

D. Correct.
A delete lock prevents accidental or unauthorized deletion at the applied scope while allowing permitted read operations.