* In the Azure portal, type App services App services from the search results.
* Click the Create app service
* In the Resource Group section, click the link to create a new resource group.
* Give the resource group a name such as Intranet11597200RG and click OK.
* In the Instance Details section, enter field.
* In the Runtime stack field, select any runtime stack such as .NET Core 3.1.
* Click the Review + create
* Click the Create button to create the web app.
* Click the Go to resource button to open the properties of the new web app.
* In the Settings section, click on
* Click the App Service Authentication slider to set it to On.
* In the Action to take when request is not authentication box, select Log in with Azure Active Directory.
* Click Save to save the changes.

Delegated permissions - Your client application needs to access the web API as the signed-in user, but with access limited by the selected permission. This type of permission can be granted by a user unless the permission requires administrator consent.
Incorrect Answers:
A, D: Application permissions - Your client application needs to access the web API directly as itself (no user context). This type of permission requires administrator consent and is also not available for public (desktop and mobile) client applications.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-access-web-apis

Explanation

Box 2: No
Use of Microsoft Authenticator is not required.
Note: Microsoft Authenticator is a multifactor app for mobile devices that generates time-based codes used during the Two-Step Verification process.
Box 3: No
The New York IP address subnet is included in the "skip multi-factor authentication for request.
References:
https://www.cayosoft.com/difference-enabling-enforcing-mfa/

Explanation

Box 1: Label 2 only
How multiple conditions are evaluated when they apply to more than one label
* The labels are ordered for evaluation, according to their position that you specify in the policy: The label positioned first has the lowest position (least sensitive) and the label positioned last has the highest position (most sensitive).
* The most sensitive label is applied.
* The last sublabel is applied.
Box 2: No Label
Automatic classification applies to Word, Excel, and PowerPoint when documents are saved, and apply to Outlook when emails are sent. Automatic classification does not apply to Microsoft Notepad.
References:
https://docs.microsoft.com/en-us/azure/information-protection/configure-policy-classification

Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group