Explanation:

Explanation:
Identify all the accounts that are assigned the Global Administrator role permanently: Microsoft Entra Insights Review the PCI of User1: Analytics In Microsoft Entra Permissions Management, the Microsoft Entra Insights tab provides role-focused visibility into directory privileges. The SC-300 materials describe it as the place to surface "standing privileges for Microsoft Entra roles" and to identify accounts with high-risk assignments such as Global Administrator. The insights view surfaces who has those roles and whether they're permanent (standing) versus eligible or time-bound, enabling you to quickly "identify high-impact directory roles and users with persistent assignments." The Analytics tab is centered on identities, resources, and actions, featuring risk and usage metrics, including the Permission Creep Index (PCI). The study content explains that Analytics lets you "drill into an identity' s effective permissions and risk score (PCI) to compare granted vs. used permissions." For a specific user (e.
g., User1), you navigate to Analytics # Identities, search/select the user, and view the PCI card and detailed breakdown of unused vs. used permissions.
Accordingly: to find permanent Global Administrator assignments, use Microsoft Entra Insights; to review User1's PCI, use Analytics.

Explanation:

Explanation:

According to the official Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn documentation on "Implement and manage self-service password reset (SSPR)", configuration of SSPR requires settings in both Azure AD and Azure AD Connect.
* Azure AD Configuration (Password reset blade):In the Azure AD admin center, the Password reset blade includes three primary sections: Properties, Authentication methods, and Registration.
* The Authentication methods section determines which verification methods users can use when resetting their password.
* To meet the requirement that users must respond to a mobile app notification or answer three security questions, you must configure these under Authentication methods.Microsoft documentation explicitly states:
"In the Authentication methods section of the Password reset settings, choose which methods users can use, such as mobile app notification, email, or security questions."
* Azure AD Connect Configuration:When users reset their password in Azure AD or on-premises, synchronization must occur both ways to ensure passwords remain consistent.
* Enabling Password writeback in Azure AD Connect allows password changes made in Azure AD (such as through SSPR) to be written back to the on-premises Active Directory.The study guide confirms:
"Password writeback enables users who change or reset their password in Azure AD to have that new password written back to their on-premises Active Directory." Therefore, to meet both requirements - user verification via mobile app or security questions and password synchronization between cloud and on-premises - the correct configuration is:
* From the Password reset blade: Authentication methods
* From Azure AD Connect: Password writeback

Explanation:
Yes
NO
No
This question tests understanding of Azure Managed Identities - both system-assigned and user-assigned - and their regional restrictions and role assignment capabilities.
Let's break it down carefully based on official Microsoft documentation and SC-300 study material:
* VM1 Region: East US
* System-assigned Managed Identity: Disabled (so we can only use user-assigned identities)
* Managed Identities available:
* Managed1 - East US
* Managed2 - East US
* Managed3 - West US
According to Microsoft documentation:
"A user-assigned managed identity can be used only by resources in the same Azure region as the managed identity." That means:
* A VM in East US can use user-assigned managed identities that are also located in East US only.
* A VM in East US cannot use a user-assigned managed identity created in West US.
Therefore:
* # Managed2 (East US) # can be assigned to VM1 (East US).
* # Managed3 (West US) # cannot be assigned to VM1 (East US).
The question also includes:
"You can assign VM1 the Owner role for RG1."
Per Azure RBAC design and SC-300 guidelines:
* Azure roles (such as Owner, Contributor, Reader) can only be assigned to Azure AD security principals, which include users, groups, service principals, and managed identities - but not to Azure resources themselves (like a VM directly).
* Therefore, you cannot assign a role to VM1 as an object; you can only assign roles to VM1's managed identity (if it had one enabled).
Since VM1's system-assigned identity is disabled and the user-assigned identity (Managed1) already attached cannot represent the VM itself for new role assignments, VM1 cannot directly hold the Owner role for RG1.