A. Incorrect.
DNS zones do not store sign-in logs.

B. Correct.
Sending Entra logs to Log Analytics enables log queries and log-based alerts.

C. Incorrect.
Recovery Services vaults store backup and recovery data, not sign-in analytics logs.

D. Incorrect.
A public IP prefix is unrelated to monitoring.

A. Incorrect.
Bastion provides secure VM access and does not package governance artifacts.

B. Incorrect.
Front Door health probes monitor origins and do not deploy subscriptions.

C. Correct.
Azure Blueprints can package resource groups, policies, role assignments, and templates for repeatable subscription deployments.

D. Incorrect.
Files snapshots protect files and do not deploy governance patterns.

A. Incorrect.
Azure Files is file storage and not a globally distributed NoSQL database.

B. Incorrect.
DNS does not store application data.

C. Incorrect.
A local CSV file is not resilient or globally replicated.

D. Correct.
Azure Cosmos DB provides globally distributed NoSQL data with configurable consistency and replication.

A. Correct.
Azure Synapse Analytics combines enterprise data warehousing and big-data analytics capabilities.

B. Incorrect.
Bastion is for VM access.

C. Incorrect.
Private DNS provides name resolution.

D. Incorrect.
Load Balancer distributes traffic and does not provide analytics.

A. Incorrect.
Anonymous blob access is unrelated and insecure.

B. Incorrect.
DNS CNAMEs do not encrypt network traffic.

C. Correct.
IPsec VPN over ExpressRoute can provide Layer 3 encryption for private connectivity.

D. Incorrect.
Storage lifecycle rules manage object tiers and deletion.

A. Incorrect.
Private DNS Resolver handles DNS forwarding and does not replicate VMs.

B. Incorrect.
Advisor recommends improvements but does not provide DR replication.

C. Incorrect.
App Configuration stores settings and does not replicate VMs.

D. Correct.
Azure Site Recovery replicates workloads for disaster recovery and failover to another location.

A. Incorrect.
One fault domain does not protect against datacenter failure.

B. Correct.
Availability zones provide physically separate datacenter locations within a region.

C. Incorrect.
A single disk is a single dependency.

D. Incorrect.
A TXT record does not provide workload availability.

A. Correct.
Azure App Configuration centralizes application settings and feature flags, while secrets can remain in Key Vault.

B. Incorrect.
Bastion provides VM access and not app configuration management.

C. Incorrect.
Load balancer probes monitor backend health.

D. Incorrect.
Disk snapshots protect disks and do not manage settings.

A. Incorrect.
VM extensions affect individual VMs.

B. Incorrect.
CDN custom domains do not manage subscription governance.

C. Correct.
Management groups organize subscriptions and provide a scope for governance such as policy and access assignments.

D. Incorrect.
Storage queues store messages and do not organize subscriptions.

A. Incorrect.
Traffic Manager routes DNS traffic and does not provision identities.

B. Incorrect.
Azure Files SMB provides file shares.

C. Incorrect.
Public DNS zones do not create users.

D. Correct.
Microsoft Entra provisioning supports cloud HR-driven user provisioning with agents for on-premises Active Directory scenarios.