AD Domain authentication allows users to connect to Azure using their organization domain credentials. It requires a RADIUS server that integrates with the AD server. Organizations can also leverage their existing RADIUS deployment.
https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about#authenticate-using- active-directory-ad-domain-server

Explanation:
Cname record to DNS for frontdoor to verify and then you can add the custom domain followed by the routing rule to app1.contoso.com.
https://docs.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain#associate-the- custom-domain-with-your-front-door
https://docs.microsoft.com/en-us/azure/frontdoor/quickstart-create-front-door

The private link resource owner can perform the below-given actions over a private endpoint connection:

Option A is incorrect. Besides reviewing all private endpoint connection details, the private link resource owner can approve, reject, and even delete a private endpoint connection.
Option B is incorrect. Besides approving a private endpoint connection, the private link resource owner can review, reject, and even delete a private endpoint connection.
Option C is incorrect. A private link resource owner can review, approve, reject and even delete a private endpoint connection.
Option D is incorrect. Besides deleting a private endpoint connection, the private link resource owner can review, approve, or even reject a private endpoint connection.
Option E is correct. A private link resource owner can perform all the given actions.
References:
https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-
overview?WT.mc_id=modinfra-33046-thmaure

Explanation:
Traffic from West Europe:
Basedd on TM1 table, West Europe will trigger TM2. However, as the MinChildEndpoint is set to
2, and App4 is degraded (down), the entire TM2 will not be considered available.
This goes back to the origin TM1 that uses performance traffic-routing method, which means the closest location is App1 and naturally be the next best performance instance.
Answer = App1
Traffic from West US:
Based on TM1 table, West US will trigger TM3. However, both App2 and App6 were degraded (down), so none of them can be considered.
This goes back to the original TM1 that uses performance traffic-routing method, from TM1, the other 2 US locations would be App2 and App3. But App2 we know it's already degraded (unavailable), hence the only option would be App3.
Answer = App3
https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-faqs#how-does-traffic- manager-compute-the-health-of-a-nested-endpoint-in-a-parent-profile

Explanation:
Box 1: Yes
In order to add VM4 to LB1, you must create a new backend pool that includes VM4's network interface (vm4981) in Vnet3/Subnet3.
Box 2: Yes
VM1 is a part of the backend pool "backend1" which is associated with the virtual network Vnet2.
Box 3: No
The load balancing rule "rule1" is configured to load balance traffic on TCP port 80, not HTTPS (TCP port 443). Therefore, connections to https://10.3.0.7 will not be load balanced by LB1.