Explanation:

Explanation:

In Microsoft Entra ID (formerly Azure Active Directory), guest users (External Users) are typically added via B2B collaboration invitations. They authenticate using the identity provider (IdP) associated with the email they were invited with - such as a Microsoft account, Gmail (Google), or another organization's Azure AD tenant.
When you need to change the authentication method or identity for a guest user - for example, from [email protected] to [email protected] - you must modify their identities and ensure that their account status is enabled and synchronized with the new sign-in identity.
Step-by-step from Microsoft Documentation:
From Microsoft Learn - "Manage external collaboration settings in Microsoft Entra ID" and "Manage guest accounts in Azure AD":
Identities
Under the Overview blade of the user, the Identities section lists all linked sign-in identities for that account.
You can remove the old identity (e.g., [email protected]) and add the new one (contractor@gmail.
com) as an alternate identity or replace the existing one.
This determines which external account the guest uses to authenticate to your tenant.
Account status
Once the new identity is added, ensure the Account status remains Enabled so that the user can sign in successfully.
If disabled, the user cannot authenticate even with the new email address.
This setting controls whether the guest user object is active in the directory.
Other fields such as User principal name, Object ID, or Reset password cannot directly modify the external identity since guest authentication relies on the federated identity provider of the external email domain.
Therefore, the administrator must use Identities to register or replace the authentication address, and Account status to ensure the user can log in using the new account.

As App1 is public-facing we need an incoming security rule, related to the access of the web servers.
Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers: a SQL database, a web front end, and a processing middle tier.
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.

Explanation:

In Microsoft Azure, Role-Based Access Control (RBAC) defines what actions users can perform on resources. The Contributor role is one of the built-in Azure roles that provides extensive permissions but excludes access management rights.
According to the Microsoft Azure Administrator documentation under "Built-in roles for Azure resources", the Contributor role has the following definition:
"Grants full access to manage all Azure resources, including the ability to create and manage resources, but does not grant permission to assign roles or manage access rights." This means that a Contributor can perform any configuration or management task on a resource (such as starting, stopping, resizing, or modifying a virtual machine) but cannot grant or modify permissions for other users.
Let's analyze each option in this context:
A). Add a data disk - # Correct
A Contributor can attach, detach, or manage data disks for the VM.
These actions involve resource management operations under the Microsoft.Compute/virtualMachines namespace, which are permitted to the Contributor role.
Microsoft Documentation Reference (Compute Resource Provider Operations):
Contributors can "create, update, and delete virtual machines, disks, and configurations." B). Configure a daily backup - # Incorrect Configuring a daily backup requires permissions within the Recovery Services vault or Backup vault resource type (Microsoft.RecoveryServices/vaults/*).
The Contributor role on the VM does not automatically grant access to vault-level resources.
Hence, User1 cannot configure or schedule a daily backup without additional permissions on the vault.
C). Assign User2 the Contributor role for VM1 - # Incorrect
Assigning or modifying RBAC roles requires the Owner or User Access Administrator role because it involves operations under the Microsoft.Authorization/roleAssignments/* permission.
The Contributor role does not include these permissions.
Therefore, User1 cannot assign roles to others.
D). Upload an image of VM1 to an Azure compute gallery - # Correct
The Contributor can capture or generalize a VM and upload its image to an Azure Compute Gallery, as this operation falls under the VM and image management permissions (Microsoft.Compute/galleries/images/*).
This action is considered a resource management operation and does not require ownership or RBAC rights beyond Contributor.
E). Assign User2 the Reader role for VM1 - # Incorrect
Similar to option C, assigning RBAC roles is a management operation restricted to users with Owner or User Access Administrator privileges.
Contributors cannot modify or assign access control permissions.