Explanation
You grant data plane access by setting Key Vault access policies for a key vault.
Note 1: Grant our VM's system-assigned managed identity access to the Key Vault.
* Select Access policies and click Add new.
* In Configure from template, select Secret Management.
* Choose Select Principal, and in the search field enter the name of the VM you created earlier. Select the VM in the result list and click Select.
* Click OK to finishing adding the new access policy, and OK to finish access policy selection.
Note 2: Access to a key vault is controlled through two interfaces: the management plane and the data plane.
The management plane is where you manage Key Vault itself. Operations in this plane include creating and deleting key vaults, retrieving Key Vault properties, and updating access policies. The data plane is where you work with the data stored in a key vault. You can add, delete, and modify keys, secrets, and certificates.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm
https://docs.microsoft.com/en-us/azure/key-vault/general/secure-your-key-vault2

kubectl apply -f appl.yaml applies a configuration change to a resource from a file or stdin.
References:
https://kubernetes.io/docs/reference/kubectl/overview/
https://docs.microsoft.com/en-us/cli/azure/aks

Section: [none]
Explanation:
We need a separate rule for each condition. We also need a separate action group for each action type that we want to fire when the rule is met.
In this scenario we have three conditions (when any virtual machines are powered off, restarted, or deallocated) and one action type (you are sent an email message).
References:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-action-rules
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-metric-overview
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/action-groups

Explanation:
Box 1: 3
One virtual network for every tier
Box 2: 1
Only one subnet for each tier, to minimize the number of open ports.
Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers:
* A SQL database
* A web front end
* A processing middle tier
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.
Technical requirements:
* Move all the virtual machines for App1 to Azure.
* Minimize the number of open ports between the App1 tiers.

Explanation
Configure IP ACLing for your backends to accept traffic from Azure Front Door's backend IP address space and Azure's infrastructure services only. Refer the IP details below for ACLing your backend:
* Refer AzureFrontDoor.Backend section in Azure IP Ranges and Service Tags for Front Door's IPv4 backend IP address range or you can also use the service tag AzureFrontDoor.Backend in your network security groups.
Reference:
https://docs.microsoft.com/en-us/azure/frontdoor/front-door-faq