Correct Answer:

Explanation:
CORRECTED ANSWER: VMs on Subnet1 can connect to VMs on Subnet3: Yes | VMs on ClientSubnet can connect to the Internet: No (see currency note) | VMs on Subnet3 and Subnet4 can connect to the Internet: No (see currency note) Detailed Explanation Paris-VNet (Subnet1/Subnet2) is peered with AllOffices-VNet (Subnet3/Subnet4); VNet peering, combined with the default system routes described, allows direct connectivity between VMs across the peered networks over the Azure backbone with no gateway required for VNet-to-VNet traffic itself (the " Use remote gateways
" setting only affects transit through an on-premises gateway, not direct peer connectivity) - so Subnet1-to- Subnet3 connectivity is Yes. IMPORTANT CURRENCY UPDATE: Microsoft retired default outbound Internet access for newly created Azure VMs effective 30 September 2025. Previously, any VM without an explicit outbound method automatically received a default outbound public IP via system routes (the classical basis for a " Yes " answer here); as of today, a VM created without an explicit outbound method - a NAT gateway, a Standard Load Balancer with outbound rules, or a directly attached public IP, none of which are described in this scenario - has no outbound Internet path by default. Under current Azure behavior, both the ClientSubnet-to-Internet and Subnet3/4-to-Internet statements are No unless an explicit outbound method is added.
Official Reference
Default outbound access for VMs in Azure - retirement - https://learn.microsoft.com/en-us/azure/virtual- network/ip-services/default-outbound-access

Correct Answer: B,D  🗳️

Explanation: Only visible for NewPassLeader members. You can sign-up / login (it's free).

Correct Answer:

Explanation:
Detailed Explanation
' Users can register applications ' controls whether non-admin members can create app registrations, which provision an associated service principal - setting it to No directly satisfies the first requirement of blocking standard users from creating new service principals. ' Restrict access to Microsoft Entra ID administration portal ' controls only UI access to the Entra admin center; setting it to Yes forces non-admin users off the portal blade while leaving their underlying Microsoft Graph/PowerShell API permissions untouched, satisfying the second requirement that they can still manage their own resources programmatically. ' Restrict non-admin users from creating tenants ' and ' Users can create security groups ' address unrelated tenant- creation and group-creation scenarios, and Guest user access restrictions govern external collaboration visibility, not service-principal creation or portal access.
Official Reference
Default user permissions in Microsoft Entra ID - https://learn.microsoft.com/en-us/entra/fundamentals/users- default-permissions

Correct Answer:

Explanation:
Detailed Explanation
Linking a private DNS zone to a virtual network is a two-sided write operation: Microsoft Learn ' s Azure Private DNS FAQ states you must have write permission on both the virtual network and the private DNS zone, and that write permission can be granted through several built-in roles. The Network Contributor role grants Microsoft.Network/virtualNetworks/join/action (needed on VNet1), while the Private DNS Zone Contributor role grants Microsoft.Network/privateDnsZones/virtualNetworkLinks/write (needed on zone1.
com). No single built-in role covers both actions, and plain Reader or Contributor-at-subscription violates the case study ' s least-privilege and " grant permissions at the required scope only " requirements. Assigning Network Contributor scoped to VNet1 and Private DNS Zone Contributor scoped to zone1.com - rather than Contributor at RG2/RG3 - satisfies both technical requirements simultaneously. The hotspot ' s given answer is correct and needs no change; just be sure each role is scoped to its own resource, not to both resources collectively.
Official Reference
Azure Private DNS FAQ - virtual network links - https://learn.microsoft.com/en-us/azure/dns/dns-faq- private