In Microsoft Azure, Role-Based Access Control (RBAC) allows you to manage access to Azure resources by assigning roles to users, groups, and service principals. The Logic App Contributor role specifically grants the ability to create, edit, and manage Logic Apps but not assign permissions or modify access control (IAM).
According to the official Microsoft Azure documentation for built-in roles in Azure RBAC:
"The Logic App Contributor role lets you manage logic apps, but not access them. You can view, edit, update, and delete logic apps." In the given scenario, the Developers group needs the ability to create Azure Logic Apps within the Dev resource group. Assigning the Logic App Contributor role at the resource group level provides exactly that scope of control-users in the group can manage Logic App resources within that resource group without affecting other resources or permissions at the subscription level.
This satisfies the requirement under the principle of least privilege, as the Developers group gets only the permissions necessary to create and manage Logic Apps within Dev, and no more.
This is verified in the Microsoft Learn AZ-104 study guide under the topic "Manage Azure Role-Based Access Control (RBAC)", which emphasizes assigning the minimal level of role permissions required to complete administrative tasks at the appropriate scope (subscription, resource group, or resource).
Therefore, the proposed solution meets the goal because the Logic App Contributor role grants precisely the permissions needed.

Explanation:

Box 1: 60
One alert per minute will trigger one email per minute.
Box 2: 12
No more than 1 SMS every 5 minutes can be send, which equals 12 per hour.
Note: Rate limiting is a suspension of notifications that occurs when too many are sent to a particular phone number, email address or device. Rate limiting ensures that alerts are manageable and actionable.
The rate limit thresholds are:
SMS: No more than 1 SMS every 5 minutes.

Voice: No more than 1 Voice call every 5 minutes.

Email: No more than 100 emails in an hour.

Other actions are not rate limited.

References:
https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/monitoring-and-diagnostics/monitoring- overview-alerts.md

Explanation:
NO
NO
YES
The provided ARM template defines an Azure Storage Account resource with the following key properties:
{
" type " : " Microsoft.Storage/storageAccounts " ,
" name " : " storage1 " ,
" location " : " East US " ,
" properties " : {
" allowBlobPublicAccess " : true,
" defaultToOAuthAuthentication " : false,
" networkAcls " : {
" bypass " : " AzureServices " ,
" defaultAction " : " Allow " ,
" ipRules " : []
},
" isVersioningEnabled " : true
}
}
Let's analyze each statement based on Azure Storage behavior and documentation:
Statement 1: "Changes made to the data in storage1 can be rolled back after seven days."
# Incorrect
The property " isVersioningEnabled " : true refers to blob versioning, which maintains previous versions of objects (blobs) when they are modified or deleted. However, there is no automatic seven-day rollback period.
Versions remain indefinitely until manually deleted or managed via lifecycle policies.
Microsoft documentation:
"When blob versioning is enabled, Azure Storage automatically maintains previous versions of an object. You can restore a previous version manually, but there is no automatic rollback period." Hence, changes can be rolled back manually, not automatically after seven days.
Statement 2: "Only users located in the East US Azure region can connect to storage1."
# Incorrect
The networkAcls section specifies:
" defaultAction " : " Allow " ,
" bypass " : " AzureServices " ,
" ipRules " : []
This configuration means all network access is allowed by default ( " defaultAction " : " Allow " ). There are no IP restrictions, so users from any region can connect.
Azure documentation states:
"If the defaultAction is set to Allow, traffic from all networks can access the storage account unless specific network rules are added." Therefore, access is not restricted to the East US region.
Statement 3: "Three copies of storage1 will be maintained in the East US Azure region."
# Correct
By default, if redundancy options like ZRS or GRS are not specified, Azure Storage uses Locally Redundant Storage (LRS).
From the Microsoft study guide:
"Locally Redundant Storage (LRS) maintains three synchronous copies of your data within a single datacenter in the primary region." Since the location is " East US " and no redundancy property is explicitly defined, the default LRS applies - meaning three copies within the same region (East US).

To push and pull signed container images in Azure Container Registry (ACR), you must enable content trust.
Content trust integrates with Docker Notary and allows image publishers to sign images and consumers to verify those signatures during pull operations.
The other options do not meet the requirement:
* Add a token # controls authentication, not image signing
* Enable encryption with customer-managed keys # protects data at rest, not image signatures
* Create a connected registry # supports edge/replication scenarios, not signing

Explanation: