Because of this statement "All the Azure resources used by each department will be managed by a department administrator.." It means it will be managed by a single admin. Therefore you need:

1. One Azure AD tenant which will be that one admin

2. Multiple Subscriptions to be under one Azure AD

3. Multiple Resources, meaning every department with its own resources

=> AD is correct.

Box 1: Yes -

You can use the same account to manage multiple subscriptions. You can create an additional subscription for your account in the Azure portal. You may want an additional subscription to avoid hitting subscription limits, to create separate environments for security, or to isolate data for compliance reasons.

Box 2: No -

You cannot merge two subscriptions into a single subscription. However, you can move some Azure resources from one subscription to another. You can also transfer ownership of a subscription and change the billing type for a subscription.

Box 3: Yes -

A company can have multiple subscriptions and store resources in the different subscriptions. However, a resource instance can exist in only one subscription.

Reference:

https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription

You can move a VM and its associated resources to a different subscription by using the Azure portal.

Moving between subscriptions can be handy if you originally created a VM in a personal subscription and now want to move it to your company's subscription to continue your work. You do not need to start the VM in order to move it and it should continue to run during the move.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-machines/windows/move-vm

A. a virtual network gateway

E. a gateway subnet

To implement a solution that enables the client computers on your on-premises network to communicate to the Azure virtual machines, you need to configure a VPN (Virtual Private Network) to connect the on-premises network to the Azure virtual network. The Azure VPN device is known as a Virtual Network Gateway. The virtual network gateway needs to be located in a dedicated subnet in the Azure virtual network. This dedicated subnet is known as a gateway subnet and must be named ‘GatewaySubnet’.

https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits

Note: If you want to raise the limit or quota above the default limit, open an online customer support request at no charge.

Box 1: No -

You can assign service administrators and co-administrators in the Azure Portal but there can only be one account administrator.

Box 2: No -

You need an Azure Active Directory account to manage a subscription, not a Microsoft account.

An account is created in the Azure Active Directory when you create the subscription. Further accounts can be created in the Azure Active Directory to manage the subscription.

Box 3: No -

Resource groups are logical containers for Azure resources. However, resource groups do not contain subscriptions. Subscriptions contain resource groups.

Reference:

https://docs.microsoft.com/en-us/office365/enterprise/subscriptions-licenses-accounts-and-tenants-for-microsoft-cloud-offerings

Box 1: No -

Not all Azure regions support availability zones.

Box 2: No -

Availability zones can be used with many Azure services, not just VMs.

Box 3: No -

Availability Zones are unique physical locations within a single Azure region.

Reference:

https://docs.microsoft.com/en-us/azure/availability-zones/az-region#azure-regions-with-availability-zones

Azure containers are the backbone of the virtual disks platform for Azure IaaS. Both Azure OS and data disks are implemented as virtual disks where data is durably persisted in the Azure Storage platform and then delivered to the virtual machines for maximum performance. Azure Disks are persisted in Hyper-V VHD format and stored as a page blob in Azure Storage.

Reference:

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-pageblob-overview

Networks in Azure are known as virtual networks. A virtual network can have multiple IP address spaces and multiple subnets. Azure automatically routes traffic between different subnets within a virtual network.

The question states that FinServer must be on a separate network segment. The only way to separate FinServer from the other servers in networking terms is to place the server in a different virtual network to the other servers.

References:

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-vnet-plan-design-arm

The web apps will use custom domains. (Basic, Shared and standard Support custom domain).

The web apps each require 10 GB of storage. (basic and standard support this).

The web apps must each run in dedicated compute instances.(basic support 3 instance max where standard support 10max).

Load balancing between instances must be included. (free, shared and basic don't support load balancing. standard and above tier only support load balancing/autoscaling)

Costs must be minimized. Standard is less costier than premium and isolated. This is clear to chose the correct answer as STANDARD.

https://azure.microsoft.com/en-us/pricing/details/app-service/windows/