Explanation:
< # Properties
# Authentication methods
Self-service password reset (SSPR) in Microsoft Entra ID (formerly Azure Active Directory) is configured from the Password reset blade in the Azure portal. Microsoft Entra ID P1 includes full support for SSPR for cloud users, including the ability to configure registration and authentication requirements.
To enable SSPR for all users, Microsoft documentation specifies that administrators must configure the Properties setting. From the Password reset # Properties page, you select who can use SSPR. The available options are None, Selected, or All. Setting this option to All enables self-service password reset for every user in the tenant. This setting controls who is allowed to use SSPR, not how they authenticate.
To require users to answer four questions when registering for SSPR, Microsoft Entra ID uses the Authentication methods setting. According to the Azure Administrator study guide, this section allows administrators to define:
* Which authentication methods are available (email, mobile app, phone, security questions)
* How many methods are required to reset a password
* How many security questions users must answer during registration
Under Authentication methods # Security questions, you can configure the number of questions required for registration and number required to reset, including setting the registration requirement to four questions, exactly matching the scenario.
Other options shown in the blade (such as Administrator Policy or Usage & insights) do not control user enablement or question requirements and therefore do not meet the stated goals.

Explanation:

The correct recommendation is a Recovery Services vault with an Enhanced policy for a Recovery Services vault . Azure VM backup is an Azure Backup workload that stores protected VM recovery points in a Recovery Services vault. Microsoft describes a Recovery Services vault as the storage entity used to hold backup data for Azure services, including Azure IaaS virtual machines.
The policy must be Enhanced because VM1 has Trusted Launch enabled. Microsoft's Trusted Launch guidance states that Azure Backup, when enabled for Trusted Launch VMs, should be configured with the Enhanced Backup policy , and that Trusted Launch cannot be enabled for VMs protected by a Standard policy. Enhanced policy is still managed through Azure Backup in a Recovery Services vault and is designed for Azure VM backup scenarios that require capabilities beyond the Standard policy, including support for Trusted Launch migration and protection.
A Backup vault is not the correct storage type for standard Azure VM backup protection, a Blob Storage account is not used to store Azure VM backup recovery points directly, and lifecycle management policies apply to storage account data lifecycle rules, not VM backup. Study Guide reference: AZ-104 Monitor and back up Azure resources > Azure Backup, Recovery Services vaults, backup policies, and virtual machine protection.

To meet the technical requirement - "Use TLS for WebApp1" - the web app must be configured with a certificate that is compatible with Azure App Service for HTTPS/TLS binding.
According to the Microsoft Azure Administrator documentation on App Service Certificates and Key Vault integration, the following key points determine which certificates can be used:
* Supported Certificate Format:Azure App Service supports importing certificates in PFX (PKCS #12) format, which includes both the public and private keys necessary for TLS/SSL binding.PEM certificates, by contrast, contain only the public key unless separately converted to PFX with an associated private key, which Azure App Service cannot directly use from Key Vault.
* Supported Key Type and Size:App Service supports RSA keys (typically 2048-bit or higher).Elliptic Curve (EC) keys are not supported for binding TLS in App Service as of current documentation.
* Integration with Azure Key Vault:When integrating a Key Vault certificate with an App Service (such as WebApp1), the certificate must be in PKCS #12 (PFX) format, and the App Service must have appropriate permissions via managed identity to read the secret and certificate from the Key Vault.
From the Vault1 data provided in your scenario:
Name
Content type
Key type
Key size
Cert1
PKCS #12
RSA
2048
Cert2
PKCS #12
RSA
4096
Cert3
PEM
RSA
2048
Cert4
PEM
RSA
4096
Analysis:
* Cert1 and Cert2 are PKCS #12 certificates, so both contain the private key required for TLS.
* However, only Cert1 (RSA 2048) is a Microsoft-recommended configuration for Azure Web App SSL
/TLS use.
* Cert2 has a 4096-bit RSA key. Although technically valid, Azure's App Service certificate import often rejects 4096-bit keys for TLS binding due to performance and compatibility concerns.
* Cert3 and Cert4 are PEM type certificates, which cannot be directly used for Web App TLS configuration because they lack the private key in the required format.
Therefore, according to the Azure Administrator Exam Study Guide and Microsoft official documentation, the only valid certificate that meets the requirements is:
# Cert1 only
Final Verified Answer: # A. Cert1 only