Explanation:
Object type: An administrative unit
Role: Authentication administrator
In Azure AD Identity and Access Administration, Administrative units (AUs) let you scope delegated admin privileges to a subset of users. The study materials describe AUs as a way to "delegate administration to a subset of users by using administrative units," ensuring the support team's privileges apply only to the executives and not tenant-wide. You would place the 100 executives in a dedicated AU and then assign the support team a suitable role scoped to that AU, satisfying least-privilege principles.
For the required tasks-reset passwords and manage MFA settings-the correct least-privileged role is Authentication administrator. The role capabilities are documented as allowing you to "view, set, and reset authentication method information for non-administrators" and to "require users to re-register for MFA," which covers managing MFA settings for the executives. By contrast, Password administrator is limited to
"reset passwords for non-administrators" and does not include managing authentication methods/MFA, and Helpdesk administrator focuses on basic user help tasks and password resets without full MFA method management. Therefore, assigning Authentication administrator scoped to an Administrative unit containing only the executives meets the scenario and adheres to least privilege.

Explanation:
File1: # User2 and User3 only
File2: # User3 only
According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn documentation on Azure Role-Based Access Control (RBAC) and Storage Account Data Access , Azure roles define what operations a user can perform on storage resources (containers, blobs, file shares, queues, tables, etc.).
Let's analyze the data provided:
Storage Account Structure Name
Type
Contents
cont1
Container
File1
share1
File share
File2
User Roles User
Role
Scope
User1
Reader
Sub1
User2
Reader
Sub1
User2
Storage Blob Data Reader
storage1
User3
Storage Contributor
storage1
* Reader (at Subscription Scope):
* Grants read-only access to Azure resource metadata, but not the data within storage (no blob or file content access).
* Therefore, User1 and User2 (via Reader) can see the storage account in the portal but cannot read file contents.
* Storage Blob Data Reader:
* Grants read-only access to blob data in containers.
* Applies only to Azure Blob storage (containers), not file shares.
* Therefore, User2 can read File1 (in cont1) but not File2 (in share1).
* Storage Contributor:
* Grants full read/write access to both Blob and File shares data in the storage account.
* Therefore, User3 can read File1 and File2.
Understanding the Roles

Explanation:
< User1: User administrator
User2: Reports reader
According to the Microsoft SC-300: Identity and Access Administrator Study Guide and the Exam Ref SC-
300: Microsoft Identity and Access Administrator , Azure AD includes several predefined roles that control delegated administrative permissions in the directory. Access reviews in Azure AD (part of Identity Governance ) can be created and managed by specific roles, depending on their intended task.
The User administrator role is designed for managing users and groups. It allows the user to create and manage access reviews for groups and applications within the organization. This includes the ability to start new reviews, modify existing ones, and manage reviewers. Therefore, User1 , who must create access reviews, requires this role.
On the other hand, the Reports reader role is a read-only administrative role that allows viewing of all audit logs, sign-in logs, and reports, including access review history reports . This role cannot create or modify reviews but can access and review the outcomes of completed reviews. Therefore, User2 , who needs to review historical access review reports, should be assigned the Reports reader role.
Microsoft Learn's "Manage access reviews in Azure AD Identity Governance" module and the SC-300 Learning Path confirm:
"User administrators can create and manage access reviews for users, groups, and applications. Reports readers can view the access review results and history reports but cannot create or modify them

When configuring Global Secure Access - Internet Access for on-premises or non-Azure servers/devices (including Linux), the devices must first be onboarded into Microsoft Entra through Azure Arc. To onboard Linux servers or machines, the Azure Connected Machine agent must be installed. This agent connects the on- premises device to Azure Arc, enabling visibility, policy application, and integration with Global Secure Access.
Options such as deploying a Private Network Connector (A) or creating a Remote Network (D) apply to routing network traffic for Private Access, not onboarding non-Azure devices. Adaptive Access settings (B) are policy-level controls, not onboarding prerequisites.

Explanation:

According to the Microsoft SC-300 Study Guide and official Microsoft Learn modules "Monitor and maintain Azure AD" and "Implement and manage identity governance", different log types and reports within Azure Active Directory provide distinct insights for security and compliance management.
* Sign-in logs: The Sign-in logs provide detailed information on authentication attempts in Azure AD, including user identity, application accessed, authentication status, IP address, and geographical location. These logs help identify unusual sign-in patterns or possible compromise by tracking where and from which IP addresses users are accessing resources. The SC-300 documentation states:
"Sign-in logs in Azure AD enable administrators to analyze user authentication attempts, track IPs, and review sign-in locations to detect anomalies and secure identities."
* Audit logs: The Audit logs record changes within Azure AD, such as user creation, role assignments, application registration, or service principal modifications. These logs allow administrators to trace
"who did what and when," which is essential for compliance auditing and operational transparency.
"Audit logs in Azure AD capture directory-level changes, including updates to users, groups, applications, and service principals."
* Identity Secure Score: The Identity Secure Score in Microsoft Entra (formerly Azure AD) provides a security posture assessment for your organization's identity configuration. It offers improvement recommendations to strengthen protection, including MFA enforcement, Conditional Access, and privileged identity management.
"Identity Secure Score helps organizations assess their security configuration against Microsoft best practices and provides actionable improvement recommendations."