You have an Azure subscription, which contains the following resources: Prod-VM1 (virtual machine) Prod-Webapp1 (app service) Contoso.com (Azure AD domain services) All the resources connect to prod-vnet1. You are planning to deploy an Azure Bastion host from Prod-Bastion1 to Prod-Vnet1. Which resources can be protected by Prod-Bastion1?