Explanation:
Feature: An MFA registration policy
Grace period: 14 days
According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn documentation under "Plan, implement, and manage multifactor authentication (MFA)" , when an organization wants to require users to register for multi-factor authentication methods (such as Microsoft Authenticator, phone number, or email), this is managed through the MFA registration policy within Azure AD Identity Protection.
This feature is called "Combined security information registration" or MFA registration policy, and it allows administrators to enforce users to register for MFA and Self-Service Password Reset (SSPR). The policy defines which users are required to register and sets a grace period - the amount of time a user can postpone registration after first being prompted.
From the Microsoft official exam reference:
"The MFA registration policy allows users to postpone registration for a defined grace period. The default and maximum supported value is 14 days." During the grace period, users can skip the registration prompt but will be reminded every time they sign in until they complete registration or the grace period expires. Once the 14-day period ends, users must register their authentication methods before accessing resources.
Therefore, based on Microsoft's SC-300 study materials and Azure AD documentation:
* The correct feature used to enforce this is An MFA registration policy.
* The standard and maximum grace period before users must complete registration is 14 days.

Explanation:
User1 can use self-service password reset (SSPR) to reset his password: Yes If User1 accesses Microsoft Exchange Online, he will be authenticated by an on-premises domain controller: Yes User2 can be added to a Microsoft SharePoint Online site as a member: No Based on Microsoft's SC-300 Study Guide , Exam Ref SC-300: Microsoft Identity and Access Administrator
, and Azure AD documentation, Azure AD Connect synchronization is governed by OU filtering, authentication method, and synchronization scope.
In this configuration, Azure AD Connect is set to "Sync selected domains and OUs," and only OU1 is selected. Therefore, only objects (users, groups, etc.) located in OU1 are synchronized to Azure AD.
* User1 (in OU1) is synchronized to Azure AD. Since password writeback is enabled (as seen in the configuration "Enable password writeback"), User1 can perform Self-Service Password Reset (SSPR) from Azure AD, and the change will write back to on-premises AD. Hence, the first statement is Yes.
* Pass-through authentication is also enabled in the configuration ("Enable Pass-through authentication").
With PTA, when User1 accesses Microsoft 365 services (like Exchange Online), the authentication request is forwarded from Azure AD to an on-premises domain controller via the PTA agent. Therefore, authentication is handled by the local AD DS. Hence, the second statement is Yes.
* User2 (in OU2) is not synchronized, as OU2 was not selected in the Domain/OU filtering configuration.
This means User2 does not exist in Azure AD and cannot be granted access to Microsoft 365 resources, including SharePoint Online. Hence, the third statement is No.
This logic aligns with Microsoft documentation under "Configure filtering for Azure AD Connect," which states:
"Only objects from selected domains and organizational units are synchronized. Users outside selected OUs are excluded from Azure AD and cannot authenticate or access cloud resources."

For Identity Governance (Entitlement Management), the materials clarify who can create and manage access reviews of access packages: "To create or manage access reviews for access packages, you must be a Global administrator, an Identity Governance administrator, a catalog owner for the catalog that contains the access package, or an access package manager." The exam text also states: "User administrator does not grant the ability to manage entitlement management access reviews unless the user is delegated as a catalog owner or access package manager." Given the scenario's user roles, User3 (Identity Governance administrator) and User5 (Global administrator) satisfy these permissions and therefore can create and manage the access review for Package1. By contrast, User4 (User administrator) cannot perform this task by role alone. This selection follows the least-privilege guidance emphasized in SC-300: use specialized governance roles (Identity Governance admin or delegated catalog roles) rather than broad directory roles when possible.

Explanation:

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and official Microsoft Learn documentation ("Manage and use custom security attributes in Microsoft Entra ID") , custom security attributes allow administrators to define key-value pairs that can be applied to various Microsoft Entra objects. These attributes can be used for fine-grained access control, app governance, and conditional policies.
Who can create custom security attributes:
Custom security attributes can only be created and managed by users assigned either of these roles:
* Global Administrator
* Attribute Definition Administrator
The Security Administrator role does not have the permissions required to create or modify attribute schema definitions.
Hence, from the table:
* User1 (Global Administrator) #
* User2 (Attribute Definition Administrator) #
* User3 (Security Administrator) #
Therefore, User1 and User2 only can create custom security attributes.
To which identities can custom security attributes be assigned:
As per Microsoft documentation:
"Custom security attributes can be assigned to supported Microsoft Entra objects, including users, groups, service principals, and managed identities." This means attributes can be attached to:
* Group objects (Group1) #
* Managed identities (MI1) #
* Service principals (Service1) #
Thus, the correct assignable identities are Group1, MI1, and Service1 only.

Explanation:

In Microsoft Entra ID, Administrative Units (AUs) are logical groupings that allow delegation of administrative permissions over specific subsets of users or groups. This delegation follows scope-based role assignment principles. The Password Administrator role enables resetting user passwords, but only within the assigned scope (either at the AU level or globally).
Let's analyze the scenario step by step:
* Administrative Units and Membership Rules
* AU1 includes users where (user.department -eq "Department1") # so User1 and User2 belong to AU1.
* AU2 includes users where (user.department -eq "Department2") # so User3 belongs to AU2.
* Role Assignments
* Admin1: Password Administrator for AU1 # can manage password operations for User1 and User2.
* Admin2: Password Administrator for AU2 # can manage password operations for User3.
* Admin3: Password Administrator at Global scope # can reset passwords for all users in the tenant.
* Access Evaluation
* Admin1 # User1: Yes, because User1 is in AU1.
* Admin2 # User2: No, because Admin2's scope (AU2) doesn't include User2, who is in AU1.
* Admin3 # User3: Yes, because Admin3 has global scope and can manage all users.
However, note that Admin2 can only reset User3's password because User3 belongs to AU2.
Thus, applying SC-300 documentation logic:
"Administrators can perform their role's permitted actions only on objects within their administrative unit scope, unless their role assignment is global."