Explanation:
According to the Microsoft SC-300 Study Guide, Exam Ref SC-300, and Microsoft Entra External Collaboration (B2B) documentation, the configuration of External collaboration settings in Azure AD determines how guest users can access directory data and who can invite them into the tenant.
Let's analyze each requirement in context:
"Guest users must be prevented from querying staff email addresses."
To achieve this, Azure AD provides the setting Guest user access restrictions, which defines what a guest can see in the directory. The most restrictive setting ensures that guest users can only see their own profile details and no other users or groups.
# Therefore, select:
"Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)." This prevents guests from discovering internal directory data such as email addresses of staff members or group memberships.
"Guest users must be able to access the tenant only if they are invited by User1." User1 has the User Administrator role. This role is included among the "specific admin roles" allowed to invite guest users when the setting is configured appropriately.
To meet the requirement that only User1 (or other admins) can invite guests, you must configure:
# "Only users assigned to specific admin roles can invite guest users." This restricts invitation privileges to admin roles (such as Global Administrator, User Administrator, etc.) and prevents ordinary users or guests from inviting others.
"Guests should not be able to self-enroll."
Azure AD B2B allows self-service sign-up through user flows (Identity Experience Framework). Enabling this feature would let external users sign up themselves - which violates the condition that guests must be invited by User1 only.
# Therefore, set Enable guest self-service sign-up via user flows = No.
Setting
Value
Guest user access restrictions
Guest user access is restricted to properties and memberships of their own directory objects (most restrictive) Guest invite restrictions Only users assigned to specific admin roles can invite guest users Enable guest self-service sign-up via user flows No
# Microsoft Official Documentation Reference (SC-300 Content):
"To prevent guests from seeing other users in the directory, configure guest user access restrictions to 'most restrictive.' To control who can invite guests, use the setting that limits invitations to users with admin roles.
To disallow self-service guest access, disable user flows for external sign-up."

In Azure AD, license automation is implemented through group-based licensing. The SC-300 materials explain that "you can assign licenses to a group in Azure Active Directory; when you assign a license to a group, all users who are members of the group are assigned that license". They also clarify that "dynamic group membership uses rules to automatically add or remove users based on user attributes", which is the recommended way to on-board new populations without manual effort. For licensing, the guide is explicit that
"group-based licensing works with security groups and Microsoft 365 Groups" and that "distribution lists are not supported for license assignment". Administrative Units are described as "a scoping mechanism for delegating administrative permissions to subsets of users and devices", not a licensing entity. Likewise, Organizational Units (OUs) are on-premises AD containers and "do not control license assignment in Azure AD".
Given the requirement to allocate licenses automatically to new A. Datum users as they appear, the least- effort, policy-driven approach is to create an Azure AD Dynamic User security group with a membership rule that targets those users (for example, by domain, company attribute, or a synced attribute), then assign the required Microsoft 365/Azure AD licenses to that group. As the documentation notes, "when users join or leave the group based on the rule, licenses are added or removed automatically."

According to Microsoft's Azure Active Directory roles and permissions reference, the User Administrator role has the following capabilities:
* Reset passwords for most non-admin users and certain administrative roles.
* Manage user and group properties, including license assignments.
While the License Administrator can manage product licenses, they cannot reset user passwords. Conversely, the Helpdesk Administrator can reset passwords but not manage licenses. Therefore, the only role that satisfies both requirements (reset passwords and manage licenses) is User Administrator.
Microsoft documentation confirms:
"The User Administrator can manage all aspects of users and groups, including resetting passwords, monitoring service health, and assigning licenses."

Conditional Access policies evaluate Assignments (users, cloud apps), optional Conditions, and then enforce Access controls. In SC-300, Terms of use (ToU) is enforced via Grant controls: the policy must "require terms of use" so that users must accept a specified ToU before access is granted. The documentation states that the ToU experience is applied when a policy includes the control to "require terms of use," and this control lives under the Grant section (alongside controls like require MFA, require compliant device, etc.).
Therefore, to deploy Terms1 with Policy1, configure the Grant controls and select Require terms of use and choose Terms1. Conditions or Session settings do not trigger ToU acceptance; they refine when or how access is permitted. Target resources select apps, but the enforcement of acceptance is strictly a Grant control.

Explanation:

In Conditional Access (CA), assignments determine who the policy applies to using Include and Exclude lists. A user targeted by Include but present in Exclude is not affected. CA evaluates all applicable policies for a sign-in. If any applicable policy has Block access, the sign-in is denied, even when other policies would grant access. When policies Grant access with conditions, the user must meet the configured controls (for example, Require device to be marked as compliant) to succeed.
Applying these rules: Policy1 includes Group1 and excludes Group3, targets All resources, and Blocks access. Group1 contains User1 and User3; Group3 contains User1. Therefore, User1 is excluded from Policy1 and not blocked, but User3 remains included and is blocked from all resources. Policy2 includes Group2, targets App1, and Grants access requiring a compliant device. Group2 contains User2 and User3; all devices (Device1-Device3) are Compliant. Thus, User2 can access App1 from Device2 because Policy2 is satisfied and no block applies. User1 is not in Group2 and not blocked by Policy1, so access to App1 from Device1 is allowed. User3, however, is affected by Policy1 (Block); block overrides any grant in Policy2, so User3 cannot sign in to App1 from Device3.