Server2 (east.contoso.local) already answers authoritatively for its own zone, so it only needs help reaching the parent zone and the sibling child zone; the same is true of Server3 (west.contoso.local) in reverse.
Configuring, on Server2, a conditional forwarder for contoso.local (pointed at Server1) covers the parent namespace, and a conditional forwarder for west.contoso.local (pointed at Server3) covers the sibling zone that Server2 does not itself host; together these two entries let Server2 resolve every internal namespace it doesn ' t already hold authoritatively. The mirrored configuration on Server3 - conditional forwarders for contoso.local and for east.contoso.local - gives Server3 the same complete internal coverage from its side.
Internet resolution is untouched by either change, since the scenario already states all three servers use root hints, so internet host names continue to resolve normally through the existing root hints configuration on every server. Because each server ends up able to reach its own zone (authoritative), the parent zone (via a conditional forwarder to Server1), the sibling child zone (via a conditional forwarder to the peer server), and the internet (via root hints), every internal namespace and every internet host is resolvable from Server2 and Server3, so this solution meets the stated goal.

The " Maximum failures in the specified period " setting on the Failover tab controls how many times the Cluster service will attempt to restart or move a clustered role within a rolling time window before giving up and leaving that role in a failed state -- it governs retry behavior after repeated failures of the role itself, not whether a role fails back to a node that has just come back online. The Failback setting shown on the same tab, currently " Allow failback " / " Immediately, " is the setting that actually controls return-to-preferred- owner behavior, and increasing the failure-count threshold does nothing to change that Failback configuration. Because App1 ' s Failback setting remains " Allow failback, " App1 would still automatically move back to Server1 as soon as Server1 restarts and a preferred owner order caused it to be favored, regardless of how high the maximum-failures threshold is set. Increasing this value therefore has no effect on preventing App1 from returning to Server1 once Server1 restarts, so this solution does not meet the goal.

A folder can be added as an Azure File Sync server endpoint as long as it is a normal, locally accessible NTFS folder path on a server that has already been registered with the Storage Sync Service -- there are, however, specific categories of folder that Azure File Sync explicitly disallows as server endpoints, such as the root of a volume that also holds the operating system, a folder that is already a server endpoint in another sync group, a folder containing another server endpoint ' s path (nested server endpoints on the same path chain are not supported), or a folder that resides on unsupported storage (such as certain network-attached or removable storage rather than fixed local storage). Folders that meet the ordinary criteria -- located on fixed, locally attached storage, not already in use as a conflicting endpoint elsewhere, and not the protected system-volume root -- are eligible regardless of their specific content or size. Based on the properties of the folders in this scenario, the folders that satisfy Azure File Sync ' s server endpoint requirements are Folder1 and Folder2, while the remaining folder does not meet one of the stated eligibility criteria and cannot be used as a server endpoint.

Explanation:
In Microsoft Entra ID: the Application Proxy service. On-premises: the Application Proxy connector.
Microsoft Entra Application Proxy is designed exactly for publishing an internal, Kerberos-only web application to users who authenticate with their Microsoft Entra account, using Kerberos Constrained Delegation to perform single sign-on into the app on the user ' s behalf, which minimizes administrative effort compared to re-architecting the app ' s authentication. The feature has two halves: a cloud-side component, the Application Proxy service in Microsoft Entra ID, which publishes an external URL, terminates user authentication, and brokers the connection; and an on-premises component, a lightweight Application Proxy connector installed on a server inside the corporate network, which maintains an outbound connection to the service and relays traffic to WebApp1, performing the Kerberos delegation locally where the app lives.
Because the connector only makes outbound connections, no inbound firewall changes or DMZ placement are required, unlike the retired Web Application Proxy/reverse-proxy pattern. Configuring the service in Microsoft Entra ID and the connector on-premises together completes the publishing setup with minimal administrative overhead.

Explanation:

Type of storage account: General-purpose v2. Redundancy: Zone-redundant storage (ZRS).
Standard SMB Azure file shares, which use lower-cost HDD-backed (transaction-optimized) storage rather than the SSD-backed premium file shares, are created only in a general-purpose v2 storage account, whereas the FileStorage account kind is required specifically for premium (SSD-based) file shares and BlobStorage accounts cannot host file shares at all; selecting General-purpose v2 both supports the standard, non-premium file share needed here and directly satisfies the requirement to minimize SSD-based performance costs, since premium/SSD-backed shares would be considerably more expensive for a temporary, general-purpose migration workload. Of the available redundancy options, zone-redundant storage (ZRS) synchronously replicates data across three physically separate availability zones within the region and continues to serve both read and write requests even if one entire zone becomes unavailable, satisfying the availability-during-a-zone- outage requirement, whereas locally-redundant storage (not listed in the options here but implied by the need to choose something with zone protection) offers no zone protection at all. Geo-redundant storage (GRS) and geo-zone-redundant storage (GZRS) both add asynchronous replication to a secondary, distant region on top of zone protection, which costs meaningfully more than ZRS while providing disaster-recovery protection this temporary, migration-phase workload does not require, so ZRS is the option that meets the availability requirement at the lowest additional cost.