A. Incorrect.
Device platform can target policies but does not define the reauthentication interval.

B. Correct.
Conditional Access session controls can enforce sign-in frequency and reauthentication behavior.

C. Incorrect.
Named locations identify network locations but do not by themselves require reauthentication after three hours.

D. Incorrect.
Granting access without controls does not satisfy the reauthentication requirement.

A. Incorrect.
Azure Disk Encryption has placement requirements; any tenant worldwide is not correct.

B. Incorrect.
A different region does not meet the usual Azure Disk Encryption key vault placement requirement.

C. Correct.
Disk encryption keys are stored in a Key Vault that aligns with the VM subscription and region requirements.

D. Incorrect.
Encryption keys are stored in Key Vault, not in a storage account container.

A. Incorrect.
A shared key in a script is secret-based and is not automatically removed with the VM.

B. Incorrect.
Anonymous access would be insecure and is not identity-based authorization.

C. Incorrect.
A public IP address does not grant storage permissions.

D. Correct.
A system-assigned managed identity has a lifecycle tied to the VM, so the identity is removed when the VM is deleted.

A. Correct.
Azure Firewall requires a dedicated subnet named AzureFirewallSubnet.

B. Incorrect.
GatewaySubnet is reserved for virtual network gateways, not Azure Firewall.

C. Incorrect.
AzureBastionSubnet is reserved for Azure Bastion.

D. Incorrect.
RouteServerSubnet is used for Azure Route Server, not Azure Firewall.

A. Incorrect.
Private DNS zone links provide name resolution and do not publish inbound firewall access.

B. Incorrect.
Blob lifecycle rules manage blob tiers and deletion, not network translation.

C. Correct.
Azure Firewall DNAT rules translate inbound traffic from a public IP and port to an internal destination.

D. Incorrect.
Key Vault access policies authorize vault operations and do not translate network traffic.

A. Incorrect.
ReadOnly does not allow deletion.

B. Incorrect.
ReadOnly blocks updates.

C. Incorrect.
Locks do not bypass RBAC; they add a management restriction.

D. Correct.
A ReadOnly lock prevents updates and deletion even for users who otherwise have permissions.

A. Incorrect.
A VM extension affects an individual machine and is not a subscription hierarchy scope.

B. Correct.
Management groups help apply governance such as policies and compliance initiatives across multiple subscriptions.

C. Incorrect.
A DNS label names a public endpoint and does not govern compliance.

D. Incorrect.
Service Bus queues provide messaging and do not organize governance scope.

A. Correct.
Microsoft Entra authentication enables identity-based SQL access, and Conditional Access can require MFA.

B. Incorrect.
Storage keys are unrelated to SQL database identity enforcement.

C. Incorrect.
Route tables control traffic paths and do not require MFA.

D. Incorrect.
CDN compression affects content delivery and not SQL administrator sign-in.

A. Incorrect.
Availability zones improve resiliency and are not NSG identity groups.

B. Incorrect.
Recovery Services vaults store backup and recovery data.

C. Correct.
Application security groups let NSG rules refer to logical groups of network interfaces.

D. Incorrect.
Advisor recommendations do not define NSG source or destination groups.

A. Incorrect.
AcrPull allows only pulling images and cannot push new images.

B. Incorrect.
Reader can view resources but cannot push container images.

C. Incorrect.
DNS Zone Contributor manages DNS zones and is unrelated to Container Registry.

D. Correct.
AcrPush permits both pushing and pulling container images.