A. Correct.
Agility is the ability to respond quickly to changing business or technical requirements by provisioning, scaling, or changing cloud resources rapidly.

B. Incorrect.
Predictability is about consistent performance and cost planning, not the speed of adapting to new requirements.

C. Incorrect.
Fault tolerance helps a workload continue after failures, but it does not describe rapid change and deployment.

D. Incorrect.
Capital expenditure is an upfront spending model. Cloud adoption usually shifts many costs toward operational expenditure.

A. Incorrect.
Azure Dedicated Host gives you a physical server dedicated to your organization. It is not a serverless compute service.

B. Incorrect.
Azure Virtual Machines require you to manage the operating system and VM lifecycle, so they are infrastructure as a service rather than serverless.

C. Correct.
Azure Functions runs event-driven code without requiring you to manage servers, capacity, or the underlying host infrastructure.

D. Incorrect.
A storage account stores data. It can trigger serverless workflows, but it is not itself the serverless compute service.

A. Incorrect.
Tags are useful for organization, reporting, and cost allocation, but they do not grant access.

B. Correct.
Azure RBAC assigns permissions to users, groups, service principals, or managed identities at a scope such as a management group, subscription, resource group, or resource.

C. Incorrect.
Resource groups provide a management scope, but permissions still come from Azure RBAC assignments.

D. Incorrect.
Application security groups help group virtual machines for network security rules. They do not grant management permissions.

A. Incorrect.
Adding another network interface does not isolate the VM; it can increase the VM's network reach.

B. Incorrect.
Resource groups organize and manage resources, but they are not a network isolation boundary.

C. Incorrect.
The operating system choice does not isolate Azure network connectivity between virtual machines.

D. Correct.
A separate virtual network provides network isolation unless you intentionally connect networks with peering, VPN, or another routing path.

A. Incorrect.
Continents are broader than the Availability Zone boundary and are not how zones are defined.

B. Correct.
Availability Zones are physically separate datacenter locations inside an Azure region, with independent power, cooling, and networking.

C. Incorrect.
Region pairs and multi-region architectures can improve resiliency, but an Availability Zone is contained within one region.

D. Incorrect.
A single rack is too small a failure boundary. Zones are separate datacenter locations.

A. Incorrect.
Multifactor authentication strengthens user sign-in, but it is not a secret store for deployment credentials.

B. Incorrect.
Azure Information Protection classifies and protects documents and emails; it is not the right store for deployment secrets.

C. Correct.
Azure Key Vault is used to store and manage secrets, keys, and certificates securely for applications and deployment workflows.

D. Incorrect.
Microsoft Defender for Cloud helps assess and protect cloud security posture, but it is not where deployment credentials are stored.

A. Incorrect.
For standard Azure VMs, you are still responsible for the guest operating system unless you use additional managed services or automation.

B. Incorrect.
Application and document permissions remain the customer's responsibility.

C. Incorrect.
Azure provides backup services, but the customer still decides what to protect, retention, recovery objectives, and validation.

D. Correct.
With Azure Virtual Machines, Microsoft manages datacenter facilities and physical server hardware, including failed hardware replacement.

A. Correct.
Azure Cloud Shell is available from the Azure portal in a web browser and provides browser-based Bash or PowerShell.

B. Incorrect.
Azure Resource Manager is the deployment and management control plane, not a desktop app you open to access Cloud Shell.

C. Incorrect.
A network security group filters network traffic. It does not provide a shell environment.

D. Incorrect.
Access tiers are storage cost/performance settings and are unrelated to Cloud Shell access.

A. Incorrect.
DDoS Protection helps protect network endpoints from distributed denial-of-service attacks; it does not classify documents.

B. Correct.
Azure Information Protection can apply labels and protection settings such as visual markings to sensitive documents.

C. Incorrect.
Application Gateway is a web traffic load balancer and web application delivery service, not a document classification tool.

D. Incorrect.
Azure Load Balancer distributes network traffic and does not inspect or label document content.

A. Incorrect.
Microsoft Learn documentation is publicly available and does not require active Azure billing.

B. Incorrect.
The privacy statement is a public Microsoft document and is not tied to Azure compute billing.

C. Correct.
Starting a stopped VM allocates compute capacity and creates billable usage, which is blocked when a trial can no longer incur charges.

D. Incorrect.
Changing a local file name has no relationship to an Azure subscription's spending status.