From the exhibit and the SC-300 Study Guide (Access Reviews section) , the access review is configured with the reviewer type set to (Preview) Manager, and Megan Bowen as the fallback reviewer.
In Azure AD Access Reviews, when "Manager" is selected as the reviewer type, the system automatically assigns each user's Azure AD-defined manager to review their access. However, if a user does not have a manager assigned in Azure AD, the review task defaults to the fallback reviewer (in this case, Megan Bowen).
Therefore, if all access review requests are going to Megan Bowen, that means users in the tenant do not have managers properly assigned in Azure AD user attributes.
Adding the department managers as fallback reviewers does not solve the issue because the fallback reviewer receives only the reviews for users without a manager, not based on department.
Microsoft documentation states:
"When 'Manager' is selected as the reviewer, the manager property from Azure AD is used. If a user does not have a manager, the fallback reviewer is used. Adding managers as fallback reviewers will not assign reviews based on departments."

In Azure AD Privileged Identity Management (PIM), MFA can be enforced at role activation. The setting "On activation, require Azure MFA: Yes" means a user must complete MFA each time they activate the role.
Because the "Activation maximum duration (hours)" is 8 hours, any user who needs the User Administrator role beyond that window must re-activate the role and therefore perform MFA again. The study guide explains: "Requiring MFA on activation ensures strong verification at the moment privileges are elevated." It also states: "Activation maximum duration controls how long the user holds the role before needing to re- activate." For approvals, the role settings show "Require approval to activate: Yes" and "Approvers: None." PIM behavior for Azure AD roles is that "if no approver list is configured for a role, activation requests are routed to Privileged Role Administrators and Global Administrators." The exam materials emphasize: "Privileged Role Administrator manages role settings, including approval workflows, and can approve eligible activations; Global Administrator also has approval capability when no explicit approvers are defined." Therefore, the correct selections are 8 hours for MFA (per activation window) and global administrator or privileged role administrator as the approver when none are explicitly assigned.

Explanation:
User
Portal to Use
User1
Azure Active Directory admin center
User2
Microsoft 365 compliance center
User3
Microsoft Endpoint Manager admin center
This question tests your knowledge of Microsoft 365 administrative roles and their associated management portals, as defined in the Microsoft Identity and Access Administrator (SC-300) Exam Study Guide and Microsoft Learn's "Manage identity and access in Microsoft Entra ID and Microsoft 365" module.
Let's analyze each user and the roles assigned:
* Roles:
* User Administrator
* Device Administrator
* Identity Governance Administrator
User1 These are all Azure AD-based roles.
* The User Administrator role allows the management of users, groups, and password resets in Azure AD.
* The Device Administrator role applies to Azure AD joined devices.
* The Identity Governance Administrator manages Access Reviews, Entitlement Management, and Terms of Use, all of which are under Azure AD Identity Governance.
According to Microsoft documentation:
"User, Device, and Identity Governance Administrators perform their management tasks in the Azure Active Directory admin center." Portal: Azure Active Directory admin center
* Roles:
* Records Management
* Quarantine Administrator
User2 These are Microsoft Purview compliance roles, used for managing retention policies, data lifecycle management, and quarantine of messages/files.
Both are managed through the Microsoft 365 compliance center (previously known as the Security & Compliance Center). Microsoft documentation:
"Records Management and Quarantine Administrator roles allow access to compliance features such as data retention, auditing, and message quarantine, all of which are configured from the Microsoft 365 compliance center." Portal: Microsoft 365 compliance center
* Roles:
* Endpoint Security Manager
* Intune Role Administrator
User3 These roles are directly tied to Microsoft Endpoint Manager (Intune).
* The Endpoint Security Manager configures device compliance, security baselines, and endpoint protection.
* The Intune Role Administrator manages Intune roles and permissions.
Microsoft documentation:
"Administrators managing Intune roles and endpoint security policies use the Microsoft Endpoint Manager admin center (https://endpoint.microsoft.com)." Portal: Microsoft Endpoint Manager admin center

Explanation:

In a Microsoft 365 E5 environment with Global Secure Access (Microsoft Entra Internet Access) deployed, to block users from accessing a specific website (for example, https://contoso.com), the configuration process involves creating network, filtering, and security control components in sequence.
According to the Microsoft SC-300 Study Guide and official Microsoft Learn module "Configure Microsoft Entra Internet Access and Private Access", the required workflow is as follows:
* Create a remote network - This step establishes the connectivity fabric that links user devices (running the Global Secure Access client) with the Microsoft Entra Global Secure Access services. It defines network parameters and routes traffic through the Microsoft Entra inspection layer.
* Create a web content filtering policy - Within Microsoft Entra Internet Access, administrators can define filtering rules that control outbound web traffic. Here, you would add https://contoso.com as a blocked domain or URL category. This policy ensures that traffic destined for that domain is denied.
* Configure a security profile - Security profiles combine web content filtering policies, Conditional Access policies, and inspection settings. You then assign the security profile to the remote network or user group so the filtering rule applies to traffic from the enrolled devices.
These steps align with Microsoft's recommended process to "create a remote network, define filtering policy, and link via a security profile" for enforcing secure outbound access control through Global Secure Access.

To enable Security defaults for contoso.com, you should first sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator. Then, browse to Azure Active Directory > Properties and select Manage security defaults. Set the Enable security defaults toggle to Yes and select Save.
After that, you can assign Admin1 the Identity Administrator role for Au1 to enable them to manage security defaults for the tenant.
https://practical365.com/what-are-azure-ad-security-defaults-and-should-you-use-them/