Use Active Directory password authentication when connecting with an Azure AD principal name using the Azure AD managed domain.
Use this method to authenticate to SQL DB/DW with Azure AD for native or federated Azure AD users. A native user is one explicitly created in Azure AD and being authenticated using user name and password, while a federated user is a Windows user whose domain is federated with Azure AD. The latter method (using user & password) can be used when a user wants to use their windows credential, but their local machine is not joined with the domain (for example, using a remote access). In this case, a Windows user can indicate their domain account and password and can authenticate to SQL DB/DW using federated credentials.
Incorrect Answers:
D: Use Active Directory integrated authentication if you are logged in to Windows using your Azure Active Directory credentials from a federated domain.
References:
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-aad-authentication-configure

Explanation

Box 1: Label 2 only
How multiple conditions are evaluated when they apply to more than one label
* The labels are ordered for evaluation, according to their position that you specify in the policy: The label positioned first has the lowest position (least sensitive) and the label positioned last has the highest position (most sensitive).
* The most sensitive label is applied.
* The last sublabel is applied.
Box 2: No Label
Automatic classification applies to Word, Excel, and PowerPoint when documents are saved, and apply to Outlook when emails are sent. Automatic classification does not apply to Microsoft Notepad.
References:
https://docs.microsoft.com/en-us/azure/information-protection/configure-policy-classification

You need to configure the diagnostic logging for the NetworkSecurityGroupRuleCounter log.
In the Azure portal, type Network Security Groups in the search box, select Network Security Groups from the search results then select VNET01-Subnet0-NSG. Alternatively, browse to Network Security Groups in the left navigation pane.
In the properties of the Network Security Group, click on Diagnostic Settings.
Click on the Add diagnostic setting link.
Provide a name in the Diagnostic settings name field. It doesn't matter what name you provide for the exam.
In the Log section, select NetworkSecurityGroupRuleCounter.
In the Destination details section, select Archive to a storage account.
In the Storage account field, select the logs11597200 storage account.
In the Retention (days) field, enter 30.
Click the Save button to save the changes.

Reference:
https://docs.microsoft.com/en-gb/azure/key-vault/general/rbac-guide