Azure managed disks support expanding (increasing) a data disk ' s size without deallocating the VM, and Microsoft ' s documentation confirms this applies to Standard HDD, Standard SSD, and Premium SSD disks as long as the resize stays at or below 4 TiB (crossing the 4 TiB boundary does require deallocating and detaching first; Premium SSD v2 and Ultra Disk have no such restriction at any size). Disk2 is a 512 GiB Standard HDD data disk, well under the 4 TiB threshold, so increasing its size can be performed online, with no VM downtime. Decreasing (shrinking) an Azure managed disk ' s size is never supported at all, with or without downtime, regardless of disk type, due to the risk of data loss -- the only workaround is creating a new, smaller disk and copying the data across, not an in-place shrink. Changing a managed disk ' s encryption type (for example, switching between platform-managed and customer-managed keys) and changing its storage type (for example, from Standard HDD to Premium SSD) are both operations that Microsoft documents as requiring the VM to be stopped/deallocated (and, in many cases, the disk detached) before the change can be applied, since these operations affect how the disk is provisioned and served at the storage layer. Therefore, among the four choices, only increasing Disk2 ' s size can be performed without causing downtime to VM1.

Azure Disk Encryption uses BitLocker (for Windows virtual machines) to encrypt the OS and data disks, and it requires an Azure Key Vault provisioned in the same subscription and region as the virtual machine to safeguard the encryption keys and, optionally, the client secrets used to authenticate to that vault. Without an existing key vault already configured to store these keys and secrets, Azure Disk Encryption cannot be enabled on a virtual machine at all, since the encryption workflow has nowhere to securely store the material it generates. Customer Lockbox for Microsoft Azure controls Microsoft support-engineer access approval workflows and has no relationship to disk encryption. A BitLocker recovery key is generated as an output of the encryption process itself, not a prerequisite that must exist beforehand. Data-link layer encryption in Azure is not a real, separate prerequisite feature relevant to Azure Disk Encryption. Therefore, having an Azure key vault available is the actual prerequisite for implementing Azure Disk Encryption on VM1.

Explanation:
Membership in the built-in Performance Log Users group grants the rights needed to manage performance counters, trace logs, alerts, and Data Collector Sets both locally and remotely without requiring full membership in the Administrators or Power Users groups, which is what makes it the least-privilege choice for this task compared with those broader, more powerful groups. Performance Monitor Users, by contrast, can only view live performance counters in real time and cannot create, modify, or manage Data Collector Sets at all, so that group would not satisfy the stated requirement even though its name sounds closely related.
On Windows Server 2016 and later, members of the Performance Log Users group additionally need the " Log on as a batch job " user right assigned through local or group security policy before they can actually create Data Collector Sets in practice, which is a one-time environment configuration step rather than a reason to pick a different, higher-privilege group for Admin1 ' s membership. With that group membership and right in place, Admin1 uses the Performance Monitor snap-in, commonly opened as perfmon.msc, to create, configure, and manage the new Data Collector Set on Server1.

Hybrid Connections in Azure App Service establish an outbound-initiated, TCP-level tunnel from an on- premises network to a specific host and port, which lets a migrated web app running in App Service reach an on-premises resource such as a SQL Server instance without requiring any inbound firewall changes or a full site-to-site VPN. An Azure SQL managed instance would require actually migrating the database into Azure, which this scenario explicitly rules out since the database is staying on-premises. An on-premises data gateway is the connectivity mechanism used by services such as Power BI, Logic Apps, and Power Automate, not by App Service web apps reaching a database directly, and Azure Extended Network addresses extending an on-premises IP address range into Azure for lift-and-shift virtual machine scenarios, which is unrelated to this app-to-database connectivity pattern. Hybrid Connections is the App Service-native feature purpose-built for exactly this need -- letting a cloud-hosted web app reach a specific on-premises endpoint -- so configuring a Hybrid Connection is the correct action.

Explanation:
For a virtual machine to act as a router relaying traffic between two other subnets, two independent forwarding checks must both be satisfied, one at the Azure network fabric layer and one inside the guest operating system. At the Azure layer, a network interface silently drops any packet that is not addressed to one of its own configured IP addresses unless IP forwarding is explicitly enabled on that NIC; enabling IP forwarding for NIC1 in the Azure portal is what allows Azure ' s network fabric to let VM1 relay traffic that is not destined for VM1 itself. That setting alone, however, only stops Azure from discarding the packets at the network level - it does not make Windows itself forward IPv4 packets between its network adapters. Inside the guest, Windows Server needs the Routing and Remote Access Service (RRAS) role installed and configured for LAN routing (IPv4 forwarding) to actually receive a packet on one interface and forward it out toward its destination on another subnet. Installing and configuring RRAS is the standard, minimal- administrative-effort way to turn a Windows Server VM into a functioning router for this scenario, compared with the alternative options: a Windows Server Network Controller is a heavyweight SDN management role unrelated to simple point-to-point routing, and a manually run route add command only affects VM1 ' s own outbound routing decisions rather than enabling it to forward other hosts ' traffic through itself.