A. Incorrect.
Storage lifecycle policies manage blob tiers and deletion.

B. Correct.
Application Gateway rewrite rules can modify request and response headers.

C. Incorrect.
DNS TXT records store text values and cannot rewrite HTTP headers.

D. Incorrect.
A VPN client package configures VPN clients and does not modify web responses.

A. Incorrect.
Health probes test backend availability and do not filter users by country.

B. Incorrect.
Private DNS links handle name resolution and not web request filtering.

C. Correct.
A custom WAF match rule can evaluate geography and block or allow matching requests.

D. Incorrect.
Route propagation affects network routes and not Front Door WAF filtering.

A. Incorrect.
Traffic Manager and public DNS do not meet the private-only access requirement.

B. Incorrect.
NAT gateway provides outbound Internet connectivity, which the VMs do not have, and anonymous access is not appropriate.

C. Incorrect.
Backup services do not provide private app connectivity.

D. Correct.
Private Endpoint provides private connectivity, and Private DNS maps the private name to the private endpoint.

A. Correct.
Azure Private DNS Resolver with forwarding rulesets supports hybrid DNS forwarding without custom DNS VMs.

B. Incorrect.
CDN accelerates content and does not resolve private DNS.

C. Incorrect.
NSG flow logs record traffic and do not perform DNS resolution.

D. Incorrect.
Application Gateway listeners accept web traffic and do not forward DNS queries.

A. Incorrect.
Basic Load Balancer does not provide the transparent NVA chaining feature.

B. Incorrect.
Private DNS Resolver handles DNS queries and does not inspect traffic.

C. Correct.
Gateway Load Balancer chains traffic transparently through network virtual appliances.

D. Incorrect.
Azure Files SMB multichannel improves file share performance and is unrelated to NVA inspection.

A. Incorrect.
Private DNS auto-registration creates DNS records and does not route Internet traffic.

B. Incorrect.
WAF bot protection filters web requests and is not a routing pattern.

C. Incorrect.
Blob change feed records blob changes and has no routing role.

D. Correct.
Forced tunneling sends Internet-bound Azure traffic through an on-premises network path.

A. Incorrect.
A /25 provides 128 addresses before Azure reservations and is too small.

B. Correct.
A /23 provides 512 addresses before Azure reservations and is the smallest common CIDR block that can satisfy 507 hosts in Azure planning.

C. Incorrect.
A /24 provides 256 addresses before Azure reservations and is too small for 507 hosts.

D. Incorrect.
A /28 is far too small for hundreds of hosts.

A. Correct.
P2S clients often need an updated VPN client package after route or peering topology changes.

B. Incorrect.
Deleting the VNet removes the target network and does not solve routing.

C. Incorrect.
Disabling gateway transit would make the shared gateway path worse.

D. Incorrect.
Azure Bastion is for browser-based VM access, not P2S client routing.

A. Incorrect.
Blob inventory reports storage metadata and is unrelated to network latency.

B. Incorrect.
Key Vault rotation policy controls key rotation and not network monitoring.

C. Correct.
Connection Monitor measures network connectivity, latency, and reachability between endpoints.

D. Incorrect.
Advisor cost recommendations do not monitor network connectivity.

A. Incorrect.
Blob immutability protects object data and is unrelated to NSG precedence.

B. Incorrect.
App Service access restrictions apply to apps, not VNet-wide NSG precedence.

C. Incorrect.
DNS forwarding rules route DNS queries and do not enforce traffic security.

D. Correct.
Azure Virtual Network Manager security admin rules provide centralized network security enforcement that can take priority over NSGs.