A. Incorrect.
The Microsoft 365 admin center manages Microsoft 365 services and some identity/admin tasks, but it is not the main Azure resource portal.

B. Correct.
The Azure portal at portal.azure.com is the web-based console for managing Azure resources.

C. Incorrect.
Azure DevOps is for planning, source control, pipelines, and related developer workflows, not general Azure resource management.

D. Incorrect.
The pricing site helps estimate costs but does not manage deployed Azure resources.

A. Incorrect.
Microsoft Entra groups are not normally billed as standalone Azure infrastructure resources.

B. Incorrect.
Display names are metadata and do not create Azure infrastructure charges.

C. Correct.
Public IP addresses can incur charges, especially when static or reserved. Removing unused public IP resources can reduce cost.

D. Incorrect.
Role assignment descriptions are metadata and do not directly create resource consumption.

A. Incorrect.
Azure Advisor recommends improvements, but it does not enforce deployment rules.

B. Incorrect.
Azure Monitor metrics measure resource behavior. They do not prevent deployments in disallowed regions.

C. Incorrect.
Storage lifecycle rules move or delete blob data; they do not govern resource deployment locations.

D. Correct.
Azure Policy can audit or deny resource deployments that do not meet governance rules, including allowed locations.

A. Correct.
A resource group is a logical container for Azure resources that are usually managed together.

B. Incorrect.
Tags help classify resources but do not provide the same lifecycle container behavior as a resource group.

C. Incorrect.
An availability zone is a physical resiliency location within a region, not a management container.

D. Incorrect.
An SLA describes service uptime commitments. It is not an Azure resource container.

A. Incorrect.
Azure Key Vault manages secrets, keys, and certificates; it does not provide broad subscription recommendations.

B. Incorrect.
Azure Bastion provides secure browser-based RDP/SSH access to virtual machines.

C. Correct.
Azure Advisor analyzes deployed resources and provides recommendations across cost, security, reliability, operational excellence, and performance.

D. Incorrect.
Azure DNS hosts DNS zones and records. It does not analyze resource optimization.

A. Incorrect.
Load Balancer distributes traffic and does not strengthen user sign-in.

B. Incorrect.
Azure Service Health reports Azure service issues and maintenance, not user authentication factors.

C. Incorrect.
A resource lock can prevent accidental deletion or modification of resources, but it does not affect user sign-in.

D. Correct.
Multifactor authentication requires additional verification such as a phone prompt, security key, or authenticator app.

A. Incorrect.
Azure Information Protection protects and labels information such as documents and email.

B. Correct.
Azure DDoS Protection helps protect Azure network resources from distributed denial-of-service attacks.

C. Incorrect.
Identity Governance helps manage identity lifecycle and access reviews, not network volumetric attacks.

D. Incorrect.
Azure Cost Management helps analyze and control spending, not network attacks.

A. Correct.
The Microsoft Privacy Statement explains what personal data Microsoft processes, how it is processed, and the purposes for processing.

B. Incorrect.
The pricing calculator estimates Azure costs and does not explain personal data processing.

C. Incorrect.
A virtual network address space is a networking configuration value.

D. Incorrect.
A public IP SKU table describes networking capabilities, not privacy practices.

A. Incorrect.
A virtual network provides private networking and does not provide a database engine.

B. Incorrect.
Azure Files provides managed file shares, not a relational database platform.

C. Correct.
Azure SQL Database is a platform as a service relational database offering where Microsoft manages much of the database infrastructure.

D. Incorrect.
The Activity Log records subscription-level events and does not store relational application data.

A. Incorrect.
A tag can identify the resource group as production, but it does not prevent deletion.

B. Incorrect.
An SLA is a service commitment and does not control resource deletion.

C. Incorrect.
A proximity placement group influences VM physical placement for latency-sensitive workloads, not deletion protection.

D. Correct.
A delete lock prevents deletion of the locked scope while still allowing permitted read and update actions unless another lock restricts them.