Azure Content Delivery Network (CDN) is a global CDN solution for delivering high-bandwidth content. It can be hosted in Azure or any other location. With Azure CDN, you can cache static objects loaded from Azure Blob storage, a web application, or any publicly accessible web server, by using the closest point of presence (POP) server. Azure CDN can also accelerate dynamic content, which cannot be cached, by leveraging various network and routing optimizations.
Reference:
https://docs.microsoft.com/en-in/azure/cdn/

Azure Automation with Azure DevOps, using runbooks, webhooks, and PowerShell workflows.
What is runbook in Azure Devops?
Runbooks are used by operations teams to automate routine maintenance and respond to system alerts and outages. Use our template to explain runbook procedures and prep your team for the next glitch.
Reference:
https://learn.microsoft.com/en-us/training/modules/explore-azure-automation-devops

The app is single tenant authentication so users must be present in contoso directory.
https://docs.microsoft.com/en-us/azure/active-directory/develop/single-and-multi-tenant-apps With Azure AD B2B, external users authenticate to their home directory, but have a representation in your directory.
https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management- external-users

Explanation:
Box 1: Dynamic data masking
The helpdesk team must see only the last four digits of an employee's phone number.
Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal effect on the application layer. It's a policy-based security feature that hides the sensitive data in the result set of a query over designated database fields, while the data in the database isn't changed.
Box 2: Always Encrypted
Database administrators must be prevented from seeing the employees' social security numbers.
Always Encrypted is a feature designed to protect sensitive data, such as credit card numbers or national/regional identification numbers (for example, U.S. social security numbers), stored in Azure SQL Database, Azure SQL Managed Instance, and SQL Server databases. Always Encrypted allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to the Database Engine. This provides a separation between those who own the data and can view it, and those who manage the data but should have no access - on-premises database administrators, cloud database operators, or other high-privileged unauthorized users.
As a result, Always Encrypted enables customers to confidently store their sensitive data in the cloud, and to reduce the likelihood of data theft by malicious insiders.
Reference:
https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine
https://learn.microsoft.com/en-us/azure/azure-sql/database/dynamic-data-masking-overview

With Azure Blueprints, the relationship between the blueprint definition (what should be deployed) and the blueprint assignment (what was deployed) is preserved. This connection supports improved tracking and auditing of deployments. Azure Blueprints can also upgrade several subscriptions at once that are governed by the same blueprint.
Reference:
https://docs.microsoft.com/en-us/answers/questions/26851/how-is-azure-blue-prints-different-from-resource-m.html