Explanation:

In Microsoft Entra ID (formerly Azure AD), Managed Identities for Azure resources are the built-in way for an Azure resource to authenticate to other Azure services without storing credentials. Microsoft's documentation states: "Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure Active Directory." It further distinguishes the two types and clarifies the one used here: "A system-assigned managed identity is enabled directly on an Azure service instance. When enabled, Azure creates an identity for the instance in Azure AD." Microsoft also emphasizes the lifecycle binding:
"This identity is tied to the lifecycle of that service instance and is deleted when the resource is deleted." Once enabled, the resource can call Azure services by requesting tokens: "You can use this identity to obtain Azure AD tokens for authentication to services that support Azure AD authentication." Because the prompt explicitly says "system-assigned", the correct completion is managed identity. The other options do not match Microsoft's definition: a user identity refers to a human user; a service principal is the underlying object applications use but isn't what Azure terms "system-assigned"; and an Azure AD-joined device pertains to device registration, not resource-to-service authentication. Therefore, the sentence correctly reads: "An Azure resource can use a system-assigned managed identity to access Azure services."

Explanation:

Microsoft's Security, Compliance, and Identity materials describe Azure Policy as the governance service that lets you "create, assign, and manage policies" so resources "stay compliant with your corporate standards and service level agreements." Policies are enforced through effects such as Deny, Audit, Append, AuditIfNotExists, DeployIfNotExists, and Modify, which enable organizations to block non-compliant creations, append required settings, or deploy configuration automatically at the time of creation. The documentation further explains that Azure Policy "supports remediation of existing resources" by running remediation tasks for policies that use DeployIfNotExists or Modify, allowing Azure Policy to automatically bring resources into compliance without manual intervention.
Evaluation is continuous, not only at create or update time. Azure Policy "evaluates resources at deployment and regularly re-evaluates compliance," and admins can also trigger on-demand scans. This means compliance state is updated both when a resource is created/changed and during periodic background assessments, ensuring drift is detected and corrected. Together, these capabilities allow Azure Policy to enforce standards for new resources, auto-remediate existing ones, and provide ongoing compliance posture- which is why the first two statements are Yes, while the claim that evaluation occurs only on create/modify is No.

Explanation:

Microsoft's Zero Trust guidance defines three core principles: "Verify explicitly, use least-privileged access, and assume breach." In Microsoft's SCI learning content and Zero Trust overview, the model is described as one that "treats every access attempt as though it originates from an open, untrusted network" and therefore requires explicit verification using all available signals (identity, device health, location, data sensitivity, and anomalies). This directly confirms the first statement as true: Verify explicitly is a guiding principle.
The same guidance states organizations must "assume breach"-designing controls so that if an attacker is already inside, blast radius is minimized through segmentation, Just-In-Time/Just-Enough-Access, continuous monitoring, and rapid detection and response. Microsoft's Zero Trust materials repeatedly explain to "assume attackers are present" and to "contain and remediate" through defense-in-depth controls, which validates the second statement as true.
Finally, Zero Trust rejects perimeter-based implicit trust. Microsoft clarifies that the model does not rely on a trusted internal network protected by a firewall; instead it "never trusts, always verifies," continuously enforcing policy regardless of network location (on-premises or internet). Therefore, the statement that Zero Trust assumes a firewall secures the internal network from external threats is false because Zero Trust presumes no inherent safety from being "inside" the network and requires continuous verification and least- privileged access everywhere.

Explanation:
YES YES YES
Microsoft Entra Conditional Access is explicitly described by Microsoft as a system of policies that act as if- then statements: if a user wants to access a resource, then certain controls must be satisfied. These are called Conditional Access policies, and they combine assignments and access controls to enforce organizational requirements.
Among the configurable conditions in a policy is Device platforms. The documentation explains that Conditional Access identifies the device platform (Android, iOS, Windows, macOS, Linux) from the user agent and notes that this condition is typically used with grant controls such as block access or in combination with other controls. This allows administrators to block or allow access based specifically on the operating system of the user's device.
For scoping, the Users and groups assignment lets you include or exclude groups instead of individual users.
Microsoft's Entra groups overview states that you can create a Conditional Access policy that applies to a group, and that Entra supports both security groups and Microsoft 365 groups, while another architecture article notes that either a security group or a Microsoft 365 Group can be used in Conditional Access policies.

In Microsoft Purview Information Protection, pre-trained (Microsoft-provided) trainable classifiers are designed to automatically recognize specific categories of content by learning from examples rather than relying only on patterns or keywords. Microsoft's guidance explains that trainable classifiers "look for data by learning from examples," and that Microsoft supplies a catalog of "pre-trained classifiers that you can use immediately in your tenant." The documentation explicitly lists content types these classifiers can recognize, including "Resumes," along with other categories such as Source code, Threat and harassment, and more.
Because they're already trained by Microsoft, you can use them "to identify and classify items across SharePoint, OneDrive, and Exchange," and then take actions such as auto-labeling or enforcing DLP policies based on the classifier match.
By contrast, Content explorer is a reporting tool that lets you view where sensitive info types/labels were found; it doesn't identify resumes on its own. Activity explorer shows events like DLP policy matches over time. eDiscovery is used for legal hold, search, and review, not for semantic content identification. Therefore, to identify documents that are employee resumes, the correct Microsoft compliance feature is the pre-trained (Microsoft-provided) trainable classifier for Resumes.