To ensure that users can view only specific blobs based on blob index tags, the correct solution is to configure Azure Role-Based Access Control (RBAC) role assignment conditions that use Azure Blob Index Tags for fine-grained data access.
According to the Microsoft Azure Administrator documentation, Blob index tags provide the ability to categorize and filter blobs within a storage account using key-value pairs. However, controlling access to blobs based on their index tags requires role assignment conditions, which is a feature of Azure RBAC conditional access for data actions.
This functionality is part of Azure Attribute-Based Access Control (ABAC). ABAC extends RBAC by adding conditions to role assignments so that access decisions can include resource attributes such as blob index tags or security principal attributes.
When you apply an RBAC role assignment with a condition, you can restrict access at the object level within a resource type. For example, you can grant a user the Storage Blob Data Reader role but restrict their access only to blobs that contain a specific tag, such as:
@Resource[Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/Department] StringEquals
' Finance '
This configuration ensures that even if multiple users have the same role, they can only view blobs whose tags match the condition defined in their role assignment.
Alternative options explained:
* A. Just-in-time (JIT) VM access # Used for securing virtual machines via Azure Security Center, not for blob data access control.
* B. Shared access signature (SAS) # Provides temporary access to storage resources but cannot filter access based on blob index tags.
* C. Stored access policy # Used to manage SAS tokens collectively but still does not support tag-based conditional access.
Therefore, the only mechanism that supports tag-based, condition-level access control for Azure Storage blobs is Role Assignment Conditions (Azure RBAC ABAC).
This aligns with the Microsoft Azure documentation on ABAC for Azure Storage, which explicitly states:
"You can use role assignment conditions in Azure Storage to control access to blobs based on blob index tags."

Azure Container Registry (ACR) is a managed, private Docker registry service that allows you to build, store, and manage container images and artifacts. Microsoft provides three service tiers for ACR - Basic, Standard, and Premium - each offering different capabilities and performance features.
According to the Microsoft Azure Administrator documentation, Private Link integration is only available in the Premium tier of Azure Container Registry. Private Link enables you to connect to Azure services (like ACR) through a private endpoint in your virtual network, ensuring that traffic between your virtual network and the registry remains entirely within the Microsoft backbone network. This prevents exposure to the public internet and significantly enhances the security of image pull and push operations.
In the Standard and Basic tiers, ACR only supports access through public endpoints, optionally restricted by IP firewall rules or service endpoints. To configure Azure Private Link, the registry must first be upgraded to Premium tier, after which you can create a Private Endpoint associated with your registry.
Once upgraded, you can configure network rules, DNS resolution, and endpoint connections under the ACR's networking settings to fully implement private access to the registry.
Thus, the verified and Microsoft-documented answer is to upgrade the container registry to the Premium tier before configuring Azure Private Link.

Explanation:

Box 1: 60
One alert per minute will trigger one email per minute.
Box 2: 12
No more than 1 SMS every 5 minutes can be send, which equals 12 per hour.
Note: Rate limiting is a suspension of notifications that occurs when too many are sent to a particular phone number, email address or device. Rate limiting ensures that alerts are manageable and actionable.
The rate limit thresholds are:
SMS: No more than 1 SMS every 5 minutes.
Voice: No more than 1 Voice call every 5 minutes.
Email: No more than 100 emails in an hour.
Other actions are not rate limited.
References:
https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/monitoring-and-diagnostics/monitoring-overview-alerts.md

Explanation:
Users: Admin1 and Admin2 only
Group: Group1, or Group3
In Microsoft Entra ID (Azure Active Directory), Self-Service Password Reset (SSPR) is configured at the tenant level and can be scoped either to all users or to selected groups. Both who can configure SSPR and which groups are eligible are strictly defined by Microsoft Entra role permissions and group support rules.
Who can configure SSPR
Microsoft Entra documentation clearly states that only the following administrative roles are authorized to configure and manage SSPR settings:
Global Administrator
Authentication Policy Administrator
In this scenario:
Admin1 is a Global Administrator # # Allowed
Admin2 is an Authentication Policy Administrator # # Allowed
Admin3 holds Authentication Administrator and Security Administrator roles # # These roles cannot configure SSPR policies Microsoft explicitly distinguishes authentication method management from SSPR policy configuration, which is why Authentication Administrators and Security Administrators do not have permission to configure SSPR.
# Correct Users selection: Admin1 and Admin2 only
Which groups can have SSPR enabled
When enabling SSPR for Selected users, Microsoft Entra supports only assigned membership security-based groups.
According to Microsoft documentation:
Security groups (Assigned) # # Supported
Mail-enabled security groups (Assigned) # # Supported
Microsoft 365 groups # # Not supported
Dynamic groups # # Not supported
Applying this to the provided groups:
Group1 - Security, Assigned # # Eligible
Group2 - Microsoft 365, Dynamic # # Not eligible
Group3 - Mail-enabled security, Assigned # # Eligible
# Correct Group selection: Group1 or Group3 only
Final Answer Summary
Section
Correct Selection
Users
Admin1 and Admin2 only
Group
Group1 or Group3 only
Microsoft Entra Administrator documentation extract:
"Only Global Administrators and Authentication Policy Administrators can configure self-service password reset settings."
"SSPR can be enabled for security groups and mail-enabled security groups with assigned membership.
Dynamic groups and Microsoft 365 groups are not supported."
# Final Verified Answer:
Users: Admin1 and Admin2 only
Group: Group1 or Group3 only