Explanation:
Box 1: 10 years
The yearly backup point occurs to 1 March and its retention period is 10 years.
Box 2: 36 months
The monthly backup point occurs on the 1
of every month and its retention period is 36 months.
Note: Azure retention policy takes the longest period of retention for each backup. In case of conflict between
2 different policies.
Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide

When configuring a custom domain for an Azure Web App (App Service) such as webapp1, the first prerequisite is to create and configure a corresponding DNS record that maps your custom domain name (www.contoso.com) to the Azure App Service's default domain (webapp1.azurewebsites.net).
According to Microsoft Azure App Service documentation:
"Before you can assign a custom domain name to your web app, you must first create a CNAME record in your DNS provider that maps your custom domain (for example, www.contoso.com) to your app's default domain name (webappname.azurewebsites.net)." This DNS record ensures that requests to the custom domain are routed correctly to Azure's front-end load balancer hosting your web app. Only after the DNS record has propagated can you validate and bind the domain to the web app in the Azure portal.
Uploading an SSL certificate is only required for HTTPS bindings after the domain is added. Stopping the app or adding connection strings is unrelated to domain configuration.
Therefore, the first step is to create a DNS record at your domain registrar that points to your web app.

Explanation:

According to the Microsoft Azure Administrator (AZ-104) Study Guide and Azure Role-Based Access Control (RBAC) documentation, permissions to link an Azure Private DNS zone to a virtual network require access to both the virtual network resource and the DNS zone resource.
The process of linking a DNS zone to a virtual network establishes name resolution for the resources within that VNet through the Private DNS zone. To perform this operation, the user must have:
* "Microsoft.Network/virtualNetworks/*" permissions (to modify and manage VNet settings).
* "Microsoft.Network/privateDnsZones/*" permissions (to manage DNS zone links).
These permissions are granted by two built-in roles:
* Network Contributor - Allows full management of the network resources like virtual networks, subnets, and network interfaces but does not allow access to manage DNS zones.
* Private DNS Zone Contributor - Allows management of private DNS zones and their link configurations.
Therefore, to grant User1 the ability to link Zone1.com (Private DNS Zone) to VNet1, the correct approach is to assign both roles with the least privilege principle, scoped specifically to the required resources:
* Network Contributor on VNet1
* Private DNS Zone Contributor on zone1.com
Assigning the permissions at the resource level (and not at the resource group or subscription level) ensures compliance with the principle of least privilege, a core requirement of Azure governance.
This setup enables User1 to perform the exact operation (linking the Private DNS Zone to the VNet) while preventing unnecessary access to unrelated resources.
Final Verified Answer:
# Roles: Network Contributor and Private DNS Zone Contributor only
# Resources: VNet1 and zone1.com only

Explanation:

Box1 : 10.0.0.0/16
Address prefix in networking refer to the destination IP address range. In this scenario, destination is Vnet1 , hence Address prefix will be the address space of Vnet1.
Box 2 : Virtual appliance
Next hop gets the next hop type and IP address of a packet from a specific VM and NIC. Knowing the next hop helps you determine if traffic is being directed to the intended destination, or whether the traffic is being sent nowhere Next Hop -- > VM1 -- > Virtual Appliance (You can specify IP address of VM 1 when configuring next hop as virtual appliance) Box 3 : GatewaySubnet In the scenario it is asked for all the inbound traffic to Vnet1. Inbound traffic is flowing through SubnetGW.
You need to route all inbound traffic from the VPN gateway to VNet1 through VM1.So its traffic from Gateway subnet only.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/manage-route-table#create-a-route-table
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-next-hop-overview