Scale up: Get more CPU, memory, disk space, and extra features like dedicated virtual machines (VMs), custom domains and certificates, staging slots, autoscaling, and more.
You scale up by changing the pricing tier of the App Service plan that your app belongs to.
Reference:
https://docs.microsoft.com/en-us/azure/app-service/manage-scale-up

Azure Backup provides backup for virtual machines - created through both the classic deployment model and the Azure Resource Manager deployment model - by using custom-defined backup policies in a Recovery Services vault.
With the release of backup policy management, customers can manage backup policies and model them to meet their changing requirements from a single window. Customers can edit a policy, associate more virtual machines to a policy, and delete unnecessary policies to meet their compliance requirements.
Incorrect Answers:
You can't delete a Recovery Services vault if it is registered to a server and holds backup data. If you try to delete a vault, but can't, the vault is still configured to receive backup data.
Reference:
https://azure.microsoft.com/en-in/updates/azure-vm-backup-policy-management/

TXT or MX : Correct
You can use either a TXT or MX record to verify the custom domain in the Azure AD. MX records can serve the purpose of TXT records

SRV : Incorrect
SRV records are used by various services to specify server locations. When specifying an SRV record in Azure DNS DNSKEY : Incorrect Choice This will verify that the records are originating from an authorized sender.
NSEC : Incorrect Choice
This is Part of DNSSEC. This is used for explicit denial-of-existence of a DNS record. It is used to prove a name does not exist.
Reference:
https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom-domain#verify-your-custom-domain-name
https://www.cloudflare.com/dns/dnssec/how-dnssec-works/#:~:text=DNSKEY%20%2D%20Contains%20a%20public%20signing,s)%20in%20the%20parent%20zone.

For Azure AD roles in Privileged Identity Management, only a user who is in the Privileged role administrator or Global administrator role can manage assignments for other administrators. You can grant access to other administrators to manage Privileged Identity Management. Global Administrators, Security Administrators, Global readers, and Security Readers can also view assignments to Azure AD roles in Privileged Identity Management.
Only owner can create an subscription and only global administrator can perform Privileged Identity Management changes. So you can create subscription with external user and then promote him to global administrator to get things done.
As it is mentioned as it is associated with azure tenant so that tenant has an AD domain. So in azure AD the default domain ends with onmicrosoft.com. So you can't have Hotmail IDs there. Moreover always remember the principle of least privileges, when you can get your job done with Global Administrator then you should not look for owner for security purpose.
[email protected] : Correct Choice
As Admin1 is Global Administrator and part of default AD domain so Admin1 can add an Azure AD Privileged Identity Management application to Tenant1 [email protected] : Incorrect Choice As per the above Admin3 is not Global Administrator, so this option is incorrect.
[email protected] : Incorrect Choice
As per the above Admin2 is not Global Administrator, so this option is incorrect.
[email protected] : Incorrect Choice
Although this user is Global Administrator but referring to the least privileges principal and default domain consideration this option is incorrect.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-instance