Explanation:

According to the Microsoft Azure Administrator (AZ-104) Study Guide and Azure Role-Based Access Control (RBAC) documentation, permissions to link an Azure Private DNS zone to a virtual network require access to both the virtual network resource and the DNS zone resource.
The process of linking a DNS zone to a virtual network establishes name resolution for the resources within that VNet through the Private DNS zone. To perform this operation, the user must have:
* "Microsoft.Network/virtualNetworks/*" permissions (to modify and manage VNet settings).
* "Microsoft.Network/privateDnsZones/*" permissions (to manage DNS zone links).
These permissions are granted by two built-in roles:
* Network Contributor - Allows full management of the network resources like virtual networks, subnets, and network interfaces but does not allow access to manage DNS zones.
* Private DNS Zone Contributor - Allows management of private DNS zones and their link configurations.
Therefore, to grant User1 the ability to link Zone1.com (Private DNS Zone) to VNet1, the correct approach is to assign both roles with the least privilege principle, scoped specifically to the required resources:
* Network Contributor on VNet1
* Private DNS Zone Contributor on zone1.com
Assigning the permissions at the resource level (and not at the resource group or subscription level) ensures compliance with the principle of least privilege, a core requirement of Azure governance.
This setup enables User1 to perform the exact operation (linking the Private DNS Zone to the VNet) while preventing unnecessary access to unrelated resources.
Final Verified Answer:
# Roles: Network Contributor and Private DNS Zone Contributor only
# Resources: VNet1 and zone1.com only

Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to virtual machines (VMs) in your virtual network (VNet), directly through the Azure portal, without exposing public IP addresses.
# Scenario Breakdown
From the question:
You have several resources connected to a single VNet1, including:
VM1 - a virtual machine
App1 - likely an Azure App Service or web app
contoso.com - a custom domain or DNS zone
You plan to deploy an Azure Bastion host named Bastion1 into VNet1.
# What Azure Bastion Protects
According to Microsoft Learn ("What is Azure Bastion?"):
"Azure Bastion provides secure RDP and SSH connectivity to virtual machines in your virtual network directly from the Azure portal, without requiring a public IP address on your virtual machines." Key characteristics:
Works only with VMs (Windows or Linux) deployed inside the same virtual network or peered virtual networks.
Enables RDP/SSH sessions through the browser.
Does not apply to App Services, DNS zones, Azure AD, storage accounts, or any PaaS resources.
Does not provide protection for domain names or endpoints such as contoso.com.
# Analysis of Options
Resource
Description
Can Bastion protect it?
Reason
VM1
Virtual Machine in VNet1
# Yes
Bastion provides RDP/SSH access without public IP
App1
Likely an Azure Web App / PaaS
# No
Web Apps are accessed via HTTPS, not RDP/SSH
contoso.com
Custom domain / DNS zone
# No
Not a networked compute resource
# Correct Answer
# A. VM1 only
Because:
Bastion can only secure VMs through private IP connections for RDP (Windows) and SSH (Linux).
App1 (App Service) and contoso.com (custom domain) are not eligible for Bastion protection.
# Microsoft Official Documentation Extract (Azure Administrator Study Guide)
"Azure Bastion is a fully managed service that provides secure and seamless RDP and SSH connectivity to your virtual machines directly through the Azure portal over SSL. Bastion hosts are deployed per virtual network and support virtual machines within that network and any peered networks."
"Azure Bastion cannot be used to connect to PaaS services such as App Service, SQL Database, or any resource that does not have a NIC inside the virtual network."
# Final Verified Answer: A. VM1 only
Azure Bastion provides secure RDP/SSH access to VMs within the same VNet or peered VNets, but it does not apply to App Services or custom domains.

Azure VNet peering is the most common way to connect virtual networks, but in this scenario, VNet1 and VNet2 exist in different Azure AD tenants. Global or cross-tenant peering requires that both VNets be within the same Azure Active Directory tenant.
Because the question specifies that each subscription is associated with a different Azure AD tenant, VNet peering is not supported across tenants.
To establish connectivity between VNets in different tenants, the correct solution is to configure VPN gateways in both virtual networks and create a VNet-to-VNet VPN connection.
This type of connection uses the Azure VPN Gateway service to securely tunnel traffic between the VNets using IPsec/IKE protocols over the Internet.
Changing IP address spaces or moving VNets/subscriptions does not solve the cross-tenant issue securely or efficiently.
Hence, before connecting VNet1 and VNet2, you must provision virtual network gateways in both VNets.

When an Azure virtual machine is redeployed, Azure moves the VM to a new physical host. During this process, the OS disk and any attached data disks are preserved, but the temporary disk is not. On Windows VMs deployed with default settings, drive D: is the temporary disk, backed by local storage on the host.
Microsoft documentation states that the temporary disk is non-persistent and data on it can be lost during maintenance, redeploy, or deallocation events.
Files created on drive C: reside on the OS disk, which is persistent and retained across redeployments. User profile and system settings such as screen saver timeout and desktop background are stored on the OS disk and therefore remain intact after redeploy. Consequently, the only change that will be lost is data written to drive D:.

Explanation:

In this scenario, App1 consists of three distinct tiers - web front end, processing middle tier, and SQL database - each containing five virtual machines. The technical requirement specifies that the company must minimize the number of open ports between the App1 tiers, move all tiers of App1 to Azure, and ensure that all VMs are protected by backups.
According to Microsoft Azure architecture best practices for multi-tier applications (from Azure Architecture Center and the Azure Administrator curriculum), the optimal design involves:
* Deploying all tiers of App1 into a single virtual network (VNet).
* This allows all components of the application to communicate securely using private IP addresses.
* Keeping all tiers within a single VNet simplifies management, security, and monitoring while supporting Network Security Groups (NSGs) for inter-tier traffic control.
* Microsoft Documentation Extract:
"Use a single virtual network to host multi-tier applications. Divide the virtual network into multiple subnets, each representing a tier, and use network security groups (NSGs) to control traffic flow between tiers." (Source: Microsoft Learn - Design and implement virtual networks in Azure)
* Creating separate subnets for each application tier (3 total).
* Subnet 1: Web tier (internet-facing, HTTPS traffic)
* Subnet 2: Application/Processing tier (internal communication only)
* Subnet 3: Database tier (private, no internet access)
* Using NSGs, administrators can explicitly allow or deny traffic between subnets, thus minimizing open ports between tiers and meeting the security requirement.
* Microsoft Documentation Extract:
"Subnets provide isolation and segmentation within a virtual network. Each tier of an application should be deployed in its own subnet to apply network security policies and control exposure." (Source: Microsoft Learn - Azure virtual network design best practices)
* Backups and Storage Requirements:
* All VMs can use Azure Backup integrated with Recovery Services Vaults, which supports VM- level backup in a single VNet environment.
* The blueprint files are stored in Azure Blob Storage with the archive tier, ensuring compliance with the storage and access control requirements.
By using one virtual network and three subnets, Contoso ensures efficient management, minimized administrative overhead, secure isolation of application tiers, and full compliance with Azure governance and security recommendations.
# Final Verified Answer:
* Number of virtual networks: 1
* Number of subnets: 3