When designing a network virtual appliance (NVA) solution in active-active high availability (HA) mode for traffic inspection between Azure subnets, the Microsoft Azure Load Balancer Standard SKU is the recommended option.
According to the Microsoft Azure Administrator Guide (Implement and Manage Load Balancing and Network Security) and official documentation ("Azure Load Balancer HA Ports Overview" and "Deploy highly available NVAs in Azure"), the following configurations are required:
* Deploy a Standard Load Balancer (Option E):The Standard Load Balancer supports advanced high- availability features, including HA Ports, multiple front-end IPs, floating IP, and zone redundancy.The Basic SKU does not support HA Ports or multiple frontends, which are essential for this active-active scenario.
* Add a Frontend IP Configuration, Backend Pool, and Health Probe (Option C):The load balancer requires:
* A Frontend IP configuration that defines the incoming traffic address.
* A Backend pool containing the two NVAs.
* A Health probe to continuously check the operational state of each NVA, enabling automatic failover if one becomes unhealthy.This ensures uninterrupted traffic flow and compliance with the "automatic failover" requirement.
* Add Two Load Balancing Rules with HA Ports and Floating IP Enabled (Option D):
* HA Ports allow the load balancer to handle traffic on all ports for a specific frontend configuration, supporting multiple services (two in this case) without defining individual port rules.
* Floating IP (Direct Server Return) must be enabled to allow the NVAs to participate in an active- active configuration. Floating IP ensures that the return traffic bypasses the load balancer, essential for symmetric routing and consistent session handling across multiple NVAs.Disabling Floating IP would result in asymmetric flows and failed connections during failover.
Together, these three configurations meet the requirements for automatic failover, active-active NVA operation, and load balancing across multiple services with distinct IP addresses.
Azure Documentation Reference Summary (Extracted from Microsoft Learn and AZ-104 Study Guides):
* "Standard Load Balancer supports high availability using HA Ports, enabling all-port traffic load balancing."
* "For active-active NVAs, configure floating IP for both load balancing rules."
* "A frontend IP, backend pool, and health probe are mandatory for any load balancer deployment."
* "Basic Load Balancer does not support HA Ports or multiple frontend configurations." Final Verified Answer: # C, D, and E
* C. Add a frontend IP configuration, a backend pool, and a health probe.
* D. Add two load balancing rules that have HA Ports and Floating IP enabled.
* E. Deploy a Standard Load Balancer.

In Microsoft Azure Active Directory (Azure AD), there is a clear distinction between internal users (members) and external users (guests). When you need to add a large number of external users (B2B collaborators) - such as those listed in a CSV file - you must use Azure AD B2B invitation processes, not the Bulk create user operation.
According to the Microsoft Azure Administrator Study Guide and Azure AD documentation, the Bulk create user operation in the Azure portal is designed only for internal user accounts within the organization's directory. It cannot be used to create guest user accounts. Guest users must be invited to the directory using either:
* The New-AzureADMSInvitation PowerShell cmdlet, which sends invitations to external users' email addresses and creates guest accounts (userType = "Guest").
* The Azure AD portal "Bulk invite" feature, which allows uploading a CSV file containing email addresses of external users to automate guest account creation.
The documentation explicitly states:
"To invite external users (B2B collaboration users) in bulk, you must use the Bulk invite feature or PowerShell with the New-AzureADMSInvitation cmdlet. The Bulk create operation is only supported for member users." (Source: Microsoft Learn - Azure Active Directory B2B collaboration and bulk operations guide) Therefore, since the scenario uses Bulk create user, it does not meet the goal of creating guest accounts for external users.

Explanation:

In this scenario, the Azure subscription contains a storage account (storage1) with three resources:
container1 (Blob container)
folder1 (File share)
Table1 (Table storage)
User1's assigned roles:
Storage Blob Data Reader # Read-only access to Blob data (cannot write).
Storage Table Data Contributor # Read, write, and delete access to Table data.
Storage File Data SMB Share Contributor # Read and write access to Azure File shares.
Now, let ' s analyze access using key1 and SAS1.
1## Access via key1
When using an account key, access is granted to all services within the storage account-Blob, File, Queue, and Table, because the key authenticates at the account level.
However, the question specifically asks:
"To which resources can User1 write by using SAS1 and key1?"
While account keys grant access to all resources, write permissions depend on the assigned roles of User1 for that account.
User1 can:
Write to the File share (folder1) because they are a Storage File Data SMB Share Contributor.
Write to the Table (Table1) because they are a Storage Table Data Contributor.
Cannot write to the Blob container (container1) because they only have the Storage Blob Data Reader role, which is read-only.
# Therefore, using key1, User1 can write to folder1 and Table1 only.
2## Access via SAS1
The Shared Access Signature (SAS) shown in the exhibit specifies:
Allowed services: Blob, File, and Table (Queue not selected).
Allowed permissions: Read, Write, Delete, List, Add, Create, and Update.
Start and expiry: Valid from 2022 to 2030.
Protocols: HTTPS only.
SAS defines data plane access, allowing specific operations within the defined services, regardless of the user' s assigned Azure roles.
Therefore, the SAS allows:
Access to Blob service # affects container1
Access to File service # affects folder1
Access to Table service # affects Table1
However, the question specifically distinguishes SAS1 and key1. Because SAS1 defines services explicitly, the question's options match how Azure limits SAS to only those selected services.
Hence, SAS1 allows write access to:
Table1 (Table service)
container1 (Blob service)
# Therefore, using SAS1, User1 can write to Table1 and container1 only.
# Final Verified answer:
Access Method
Write Access To
key1
folder1 and Table1 only
SAS1
Table1 and container1 only
Reference Extract (Azure Documentation):
"A shared access signature (SAS) grants limited access rights to Azure Storage resources for a specified time and set of permissions. The permissions are defined per service selected (Blob, File, Queue, Table)."
"Using an account key provides full access to all data objects in the storage account, but effective access may still be limited by assigned RBAC roles if role-based access control is enforced."

Explanation:

Azure Bastion is a fully managed service that provides secure and seamless RDP/SSH connectivity to your virtual machines directly through the Azure portal - without exposing those VMs to public IP addresses.
To meet the stated requirements, let's evaluate each configuration point using verified Azure documentation principles:
1## Support for host scaling:
Host scaling (auto-scale) is available only in the Standard SKU of Azure Bastion. The Basic SKU supports a single Bastion host instance and does not scale. Therefore, to support scaling, we must use the Standard SKU.
2## Support uploading and downloading files:
The file upload/download (RDP/SSH clipboard transfer) feature is supported only by the Standard SKU of Azure Bastion. The Basic SKU does not support these advanced capabilities.
3## Support for VMs in both VNet1 and VNet2:
Since VNet1 and VNet2 are in the same region (East US) and are peered, one Bastion host can be deployed in VNet1 and used to connect to VMs in both VNets. Cross-VNet connectivity for Bastion requires VNet peering and the Standard SKU.
4## Minimize the number of addresses on the Azure Bastion subnet:
Azure Bastion requires a dedicated subnet named AzureBastionSubnet.
* The minimum supported subnet size is /26 for the Standard SKU (as it supports scaling and multiple instances).
* The Basic SKU can use /27, but since we are using Standard SKU (for scaling and file transfer), the minimum possible subnet size is /26.This meets the requirement to minimize address space usage while supporting scaling.
5## Public IP requirements:
* The Standard SKU Bastion requires a Public IP address of SKU = Standard with Static allocation.
* Basic SKU Bastion can work with Basic Public IPs, but not Standard SKU Bastion.Hence, we must use a Standard SKU Public IP with Static allocation.
# Final Verified Configuration (per Microsoft Azure Administrator Documentation):
* Subnet size: /26
* Public IP: Standard SKU with a static allocation
Rationale Summary:
This configuration supports scaling, file transfer, cross-VNet connectivity, and minimal address consumption, satisfying all requirements as per official Azure documentation on Azure Bastion Standard SKU and Bastion network design guidelines.

Azure role-based access control (RBAC) now supports role assignment conditions for finer-grained access management. Conditions are written using the Azure Resource Manager (ARM) condition language and allow you to enforce specific rules (for example, limit access to particular blobs or queues).
However, conditional access in RBAC is currently available only for data actions in Azure Storage accounts and Azure Key Vault. According to the Microsoft Learn documentation for Azure Storage RBAC with conditions, the following services support conditional role assignments:
* Blob storage (containers and blobs)
* Queue storage
This means that you can apply conditions on containers (for blobs) and queues, but not on file shares or tables.
Conditions can restrict access to:
* Specific container names or blob prefixes.
* Specific queue names or messages.
For example, you could allow a user to read blobs only under a given prefix or queue, enhancing least- privilege control.
# Supported: Containers (Blob storage), Queues
# Not supported: File shares, Tables
Microsoft Azure Reference (Conceptual Summary):
" You can add conditions to Azure role assignments for blob and queue data actions. Conditions are not yet supported for Azure Files or Tables. " (Source: Microsoft Learn - Azure role assignment conditions for storage data actions)