Explanation

Number of VM instances: 4
You are not charged extra for deployment slots.
Pricing tier: Isolated
The App Service Environment (ASE) is a powerful feature offering of the Azure App Service that gives network isolation and improved scale capabilities. It is essentially a deployment of the Azure App Service into a subnet of a customer's Azure Virtual Network (VNet).
References:
https://azure.microsoft.com/sv-se/blog/announcing-app-service-isolated-more-power-scale-and-ease-of-use/

Explanation
Box 1: groupMembershipClaims
Personalization of the website must be based on membership in Active Directory groups.
Group claims can also be configured in the Optional Claims section of the Application Manifest. Enable group membership claims by changing the groupMembershipClaim The valid values are:
- "All"
- "SecurityGroup"
- "DistributionList"
- "DirectoryRole"
Here we need to mention that we want to get the groups for the users. Hence we need to mention to set the groupMembershipClaims property to All.
Box 2: oauth2AllowImplicitFlow
Azure AD users must be able to login to the website.
auth2Permissions can only accept collections value like an array, not a boolean. oauth2AllowImplicitFlow accepts boolean value.
Here from the list of options given, if we want the application to fetch the required tokens , we would need to allow Implicit Flow.

Explanation

Register a new application using the Azure portal
* Sign in to the Azure portal using either a work or school account or a personal Microsoft account.
* If your account gives you access to more than one tenant, select your account in the upper right corner.
Set your portal session to the Azure AD tenant that you want.
* Search for and select Azure Active Directory. Under Manage, select App registrations.
* Select New registration. (Step 1)
* In Register an application, enter a meaningful application name to display to users.
* Specify who can use the application. Select the Azure AD instance. (Step 2)
* Under Redirect URI (optional), select the type of app you're building: Web or Public client (mobile & desktop). Then enter the redirect URI, or reply URL, for your application. (Step 3)
* When finished, select Register.

Explanation
Text Description automatically generated

To perform a key transfer, a user performs following steps:
* Generate KEK.
* Retrieve the public key of the KEK.
* Using HSM vendor provided BYOK tool - Import the KEK into the target HSM and exports the Target Key protected by the KEK.
* Import the protected Target Key to Azure Key Vault.
Step 1: Generate a Key Exchange Key (KEK).
Step 2: Retrieve the Key Exchange Key (KEK) public key.
Step 3: Generate a key transfer blob file by using the HSM vendor-provided tool.
Generate key transfer blob using HSM vendor provided BYOK tool
Step 4: Run the az keyvault key import command
Upload key transfer blob to import HSM-key.
Customer will transfer the Key Transfer Blob (".byok" file) to an online workstation and then run a az keyvault key import command to import this blob as a new HSM-backed key into Key Vault.
To import an RSA key use this command:
az keyvault key import
Reference:
https://docs.microsoft.com/en-us/azure/key-vault/keys/byok-specification

Explanation
Graphical user interface, text, application Description automatically generated