Explanation:

Microsoft's Azure networking services have distinct roles that map directly to the statements in the prompt.
Azure Firewall is a stateful, cloud-native network security service that explicitly supports Source NAT (SNAT) and Destination NAT (DNAT) to control and translate traffic flows. In Microsoft's description, Azure Firewall "provides network address translation (SNAT/DNAT) and filtering for inbound and outbound traffic," making it the correct match for NAT services.
Azure Bastion is designed to deliver "secure and seamless RDP and SSH connectivity to your virtual machines directly from the Azure portal over TLS" without exposing a public IP on the VM. This aligns precisely with secure Remote Desktop connectivity to Azure virtual machines.
Network security groups (NSGs) are Azure's built-in mechanism for traffic filtering. Microsoft explains that an NSG "contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources" and that rules can be applied to subnets or to individual network interfaces (NICs) on a virtual network. Therefore, NSGs are the right choice for traffic filtering applied to specific network interfaces.
Together, these mappings reflect Azure's layered network security model: NSGs for rule-based filtering at NIC/subnet, Azure Firewall for centralized stateful inspection and NAT, and Azure Bastion for secure, browser-based RDP/SSH access.

The Service Trust Portal is Microsoft's public-facing portal that centralizes how Microsoft manages privacy, compliance, and security for its cloud services. It provides independent audit reports, compliance guides, data protection resources, and details on Microsoft's internal controls and practices. It's the authoritative place to learn how Microsoft meets global, regional, and industry standards.

Explanation:

Box 1: Yes
Azure Defender provides security alerts and advanced threat protection for virtual machines, SQL databases, containers, web applications, your network, your storage, and more Box 2: Yes Cloud security posture management (CSPM) is available for free to all Azure users.
Box 3: Yes
Azure Security Center is a unified infrastructure security management system that strengthens the security posture of your data centers, and provides advanced threat protection across your hybrid workloads in the cloud - whether they ' re in Azure or not - as well as on premises.
Reference:
https://docs.microsoft.com/en-us/azure/security-center/azure-defender
https://docs.microsoft.com/en-us/azure/security-center/defender-for-storage-introduction https://docs.
microsoft.com/en-us/azure/security-center/security-center-introduction

In the Microsoft 365 Defender (Microsoft Defender XDR) portal, the Reports area is the feature designed to surface security trends and provide protection status views across workloads, including identities. Microsoft guidance explains that the Reports workspace offers curated dashboards and exportable reports for specific domains (for example, Identities, Email & collaboration, Endpoints), so security teams can review trend lines, coverage/health, and status without running queries. For identities specifically (backed by Microsoft Defender for Identity), the reports include overview dashboards and scheduled/on-demand reports that show items such as identity security posture, open health issues, alert volumes over time, and sensor/coverage status. This aligns with SCI learning paths that distinguish portal areas by purpose: Secure score is a measurement of overall posture and recommended actions, Incidents is for triage and response to individual cases, and Hunting is for ad-hoc, query-driven investigations. When the task is to "view security trends and track the protection status of identities," Microsoft directs administrators to the Reports > Identities experience in the Defender portal, which provides the built-in, continuously updated visualizations and summaries required for ongoing monitoring.

Explanation:

Microsoft's shared-responsibility model states that the cloud provider secures the cloud, while the customer secures what they put in the cloud. The Azure Security documentation explains: "Regardless of the type of deployment, you always retain responsibility for your data, endpoints, accounts, and access management." This applies to IaaS, PaaS, and SaaS, so statement 3 is Yes because the organization is always accountable for the security of information and data.
For SaaS, Microsoft describes that customers "don't manage or control the underlying cloud infrastructure- including network, servers, operating systems, or even individual application capabilities" and that the provider handles service maintenance and updates. In SaaS, tasks like patching or applying service packs to the application code are owned by the service provider, while the customer focuses on data, identity, and access. Therefore, statement 1 is No.
For IaaS, Microsoft notes the provider manages the physical estate: "Microsoft is responsible for the physical hosts, network, and datacenter facilities," while the customer configures and secures the guest OS, applications, and network controls within their subscription. Thus, managing the physical network is the cloud provider's duty, making statement 2 Yes.
These SCI principles are foundational to Microsoft Learn/Docs guidance on Azure's shared responsibility:
provider-"security OF the cloud"; customer-"security IN the cloud," with data protection always remaining the customer's responsibility.