You have an Azure subscription that contains the virtual machines shown in the following table.

VNET1, VNET2, and VNET3 are peered with each other. You perform the following actions:
* Create two application security groups named ASG1 and ASG2 in the West US region.
* Add the network interface of VM1 to ASG1.

You have a Microsoft Entra tenant.
You need to prevent nonprivileged Microsoft Entra users from creating service principals in Microsoft Entra ID.

You have an Azure subscription named Sub 1 that is associated to an Azure AD Tenant named contoso.com.
The tenant contains the users shown in the following table.

Each user is assigned an Azure AD Premium P2 license.
You plan to onboard and configure Azure AD Identity Protection.
Which users can onboard Azure AD Identity Protection, remediate users, and configure policies? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

You have an Azure subscription that contains a user named UseR1. You need to ensure that UseR1 can perform the following tasks:
* Create groups.
* Create access reviews for role-assignable groups.
* Assign Azure AD roles to groups.
The solution must use the principle of least privilege. Which role should you assign to User1?

You have an Azure subscription that contains a virtual network named VNet1. The subscription contains an Azure App Service web app named App1.
You have an Azure Front Door profile named AFD1 that has an Azure Web Application Firewall (WAF) policy.
You need to ensure that all inbound traffic to App1 is filtered through AFD1.
What should you do?