You need to recommend a solution for securing the landing zones.

One of the stipulations is to meet the business requirements of minimizing costs. ExpressRoute is expensive.

Given the landing zone requirements of

1) "Use a DNS namespace of litware.com"

2) "Ensure that the Azure virtual machines in each landing zone communicate with Azure App Service web apps in the same zone over the Microsoft backbone network, rather than over public endpoints"