Generally available: Encryption scopes on hierarchical namespace enabled storage accounts Encryption scopes introduce the option to provision multiple encryption keys in a storage account with hierarchical namespace. Using encryption scopes, you now can provision multiple encryption keys and choose to apply the encryption scope either at the *container* level (as the default scope for blobs in that container) or at the blob level. The capability is available for REST, HDFS, NFSv3 and SFTP protocols in an Azure Blob / Data Lake Gen2 storage account.
The key that protects an encryption scope may be either a Microsoft-managed key or a customer- managed key in Azure Key Vault. You canchoose to enable automatic rotation of a customer- managed key that protects an encryption scope. When you generate a new version of the key in your Key Vault, Azure Storage will automatically update the version of the key that is protecting the encryption scope, within a day.
Reference:
https://azure.microsoft.com/da-dk/updates/generally-available-encryption-scopes-on-hierarchical- namespace-enabled-storage-accounts/

Explanation:
Box 1: Five enterprise applications
Global Secure Access apps
Configuring your Quick Access settings is a major component to utilizing Microsoft Entra Private Access. When you configure Quick Access for the first time, Private Access creates a new enterprise application. The properties of this new app are automatically configured to work with Private Access.
Box 2: 5
Private network connectors
Five servers, so give network connectors needed.
Connectors are lightweight agents that sit on a server in a private network and facilitate the outbound connection to the Global Secure Access service. Connectors must be installed on a Windows Server that has access to the backend resources and applications. You can organize connectors into connector groups, with each group handling traffic to specific applications.
Windows server
The Microsoft Entra private network connector requires a server running Windows Server 2012 R2 or later. You'll install the private network connector on the server. This connector server needs to connect to the Microsoft Entra Private Access service or application proxy service and the private resources or applications that you plan to publish.
Reference:
https://learn.microsoft.com/en-us/entra/global-secure-access/concept-private-access
https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-connectors

https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-ramp-overview

Explanation：
Your recommendation will ensure non-repudiation and prevent information disclosure. Both of these are benefits provided by Public Key Infrastructure (PKI). PKI provides a framework for creating, managing, and deploying X.509 certificates that can be used to digitally sign data. A digital signature ensures nonrepudiation, meaning that the signer cannot deny, or repudiate, that their signature was used. Certificates are also used on apps and web servers to facilitate encrypted communications, such as with Hypertext Transfer Protocol Secure (HTTPS). Azure Key Vault can be used to create and manage digital certificates.
PKI does not facilitate the recovery of lost data. Azure Backup can be used to provide this benefit.
PKI does not prevent data modifications. However, digital signatures can be used to detect data modifications. If signed data has been modified, the signature will be invalid.
PKI does not enhance data availability. This is typically done using data replication schemes, clustering, and other resiliency approaches. Services like Azure Load Balancer and Azure Application Gateway can be used to enhance data availability.

Explanation:
Box 1: AD DS and Microsoft Entra ID
The number of failed sign-in attempts that trigger a lockout.
Smart lockout can be integrated with hybrid deployments that use password hash sync or pass- through authentication to protect on-premises Active Directory Domain Services (AD DS) accounts from being locked out by attackers. By setting smart lockout policies in Microsoft Entra ID appropriately, attacks can be filtered out before they reach on-premises AD DS.
When using pass-through authentication, the following considerations apply:
* The Microsoft Entra lockout threshold must be less than the AD DS account lockout threshold.
Set the values so that the AD DS account lockout threshold is at least two or three times greater than the Microsoft Entra lockout threshold.
* The Microsoft Entra lockout duration must be longer than the AD DS account lockout duration.
The Microsoft Entra duration is set in seconds, while the AD DS duration is set in minutes.
Tip
This configuration ensures Microsoft Entra smart lockout stops your on-premises AD DS accounts from being locked out by brute force attacks, like password spray attacks on your Microsoft Entra accounts.
Box 2: AD DS and Microsoft Entra ID
The duration of the lockout.
Reference:
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-smart-lockout