Explanation:

Box 1: Yes
Invitations can only be sent to outlook.com. Therefore, User1 can accept the invitation and access the application.
Box 2. Yes
Invitations can only be sent to outlook.com. However, User2 has already received and accepted an invitation so User2 can access the application.
Box 3. No
Invitations can only be sent to outlook.com. Therefore, User3 will not receive an invitation.
Based on the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn module
"Manage external collaboration settings in Azure AD", Azure Active Directory provides granular control over external collaboration through External collaboration settings and Collaboration restrictions. These settings control which external domains can receive guest invitations.
The configuration in the exhibit shows:
"Allow invitations only to the specified domains (most restrictive)"
Target Domain: Outlook.com
This means invitations can only be sent to users whose email domains are explicitly listed (in this case, Outlook.com). Any other external domain (like fabrikam.com or adatum.com) is not permitted to receive or accept invitations.
[email protected]
* Domain Outlook.com is listed under allowed domains.
* Although the invitation was initially not accepted, since the domain is allowed, User1 can accept the invitation and gain access.# Answer: Yes [email protected]
* The domain fabrikam.com is not listed in the allowed domains list.
* However, this user already accepted the invitation before the restriction was configured.
* Once a guest has accepted the invitation, they are an existing guest object in Azure AD and retain access unless explicitly removed.# Answer: Yes [email protected]
* Domain adatum.com is not listed under allowed domains.
* Therefore, this user cannot receive or accept new invitations for collaboration resources like SharePoint Online.# Answer: No Summary from Microsoft documentation:
"When collaboration restrictions are set to allow invitations only to specified domains, invitations to all other domains are blocked. Existing guest users who have already accepted invitations remain unaffected." (Source: Microsoft Learn - Configure external collaboration settings in Azure AD)

Explanation:
< GroupA: # User1, Group1, Group2, and Group3 only
GroupB: # User1, Group1, Group2, and Group4 only
According to the Microsoft Identity and Access Administrator (SC-300) Official Study Guide and the Microsoft Learn module "Manage groups in Azure Active Directory", group nesting rules in Azure AD depend on group type and membership type.
* GroupA is a Security group with an Assigned membership type.
* In Azure AD, security groups (whether assigned, dynamic user, or dynamic device) can contain users, devices, and other security groups as members.
* However, Microsoft 365 groups cannot be added to a security group because Microsoft 365 groups include collaborative services (SharePoint, Teams, Planner) that rely on unique membership and ownership models.
Therefore, GroupA (security group) can include:
* User1 (user) #
* Group1 (security - assigned) #
* Group2 (security - dynamic user) #
* Group3 (security - dynamic device) #
* # Group4 (Microsoft 365 group) - not allowed in a security group.
# Correct composition for GroupA: User1, Group1, Group2, and Group3 only.
* GroupB is a Microsoft 365 group with an Assigned membership type.
* Microsoft 365 groups can include users and security groups as members, but cannot include other Microsoft 365 groups (nested Microsoft 365 groups are not supported).
* So GroupB can include:
* User1 (user) #
* Group1 (security - assigned) #
* Group2 (security - dynamic user) #
* # Group3 (dynamic device) - device groups can't be members of M365 groups.
* Group4 (Microsoft 365 group) # - nesting M365 groups is not supported.
# Correct composition for GroupB: User1, Group1, Group2, and Group4 only.

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and Microsoft Learn documentation on Azure AD group assignments for enterprise applications, only specific group types in Azure AD can be assigned to enterprise applications (service principals).
Azure AD allows group-based assignment for enterprise applications only when the group is a Security group or a Mail-enabled security group. This is because Azure AD uses security groups for authorization purposes.
Let's analyze the groups from the table:
Group
Type
Assignable to App1?
Reason
Group1
Security
# Yes
Security groups are used for managing access permissions and can be assigned to apps.
Group2
Distribution
# No
Distribution groups are used for email distribution lists and cannot be used for access management.
Group3
Microsoft 365
# No
Microsoft 365 (formerly Office 365) groups manage collaboration resources like Teams and SharePoint but are not supported for enterprise app assignments.
Group4
Mail-enabled security
# Yes
Mail-enabled security groups combine mailing capabilities with security functionality and can be used to assign permissions to applications.
The Microsoft documentation states:
"You can assign access to enterprise applications in Azure AD to users, security groups, and mail-enabled security groups. Distribution lists and Microsoft 365 groups are not supported for app assignments." Thus, for App1, which is an enterprise application, you can assign only Group1 (Security) and Group4 (Mail-enabled Security).

Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn documentation under "Add and configure custom domains in Microsoft 365", when an organization acquires a new Microsoft 365 tenant, it starts with a default domain such as contoso.onmicrosoft.com. To use a friendly and company-branded domain like contoso.com for email and user principal names (UPNs), administrators must follow a specific sequence of steps to integrate the custom domain into Azure AD
/Microsoft 365.
First, register the custom domain in Azure Active Directory. This action adds contoso.com to your tenant and prepares Microsoft 365 to validate ownership.
After adding the domain, Microsoft 365 provides a TXT record to add to your DNS zone (at your registrar or DNS host). This record proves that your organization owns the domain.
Once the TXT record is published and propagated, return to the Microsoft 365 admin center or use PowerShell to verify the domain. This step confirms domain ownership and completes the domain setup.
Finally, after verification, set contoso.com as the primary domain. Doing this ensures that all newly created users automatically receive user principal names (email addresses) ending in @contoso.com.
Microsoft documentation states:
"After verifying ownership of the custom domain, you can set it as the default (primary) domain for new users in Microsoft 365."

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and Microsoft Learn module "Plan and implement Conditional Access policies", enabling or customizing Conditional Access policies requires that Security Defaults in Azure AD be disabled.
Security defaults provide a basic level of protection, such as enforcing MFA for all users and blocking legacy authentication. However, when Security Defaults are enabled, custom Conditional Access policies cannot be created because both features manage sign-in risk and access control.
From the Microsoft documentation:
"To use Conditional Access policies, you must disable security defaults. Conditional Access policies provide more granularity and flexibility than security defaults." Therefore, before you can control access to Microsoft 365 resources through Conditional Access, the first step is to disable Security Defaults in the Azure AD tenant.