Explanation:
User1 syncs to Azure AD: # Yes
* User2 syncs to Azure AD: # No
* Group2 syncs to Azure AD: # No
This scenario is directly covered in the Microsoft SC-300: Identity and Access Administrator exam section
"Implement Azure AD Connect synchronization" and detailed in Microsoft documentation: "Azure AD Connect: Configure filtering" .
Azure AD Connect supports multiple filtering mechanisms:
* Domain and Organizational Unit (OU) filtering - only objects in selected OUs are synchronized.
* Group-based filtering (Pilot sync) - when enabled, only members of the specified security group (and required dependency objects) are synchronized. Nested groups are not supported.
* OU Filtering:
* Both OU1 and OU2 are selected.
* Therefore, objects in both OUs are eligible for synchronization (if other filters allow).
* Group-based filtering:
* The selected filter group is Group1, located in OU2.
* Azure AD Connect synchronizes only direct members of Group1 (users, groups, or devices).
* Nested groups are ignored - their members are not recursively synchronized .
* User1:
* Is a direct member of Group1 (in OU1).
* Since User1 is directly in Group1, and OU1 is included, User1 will sync to Azure AD. # User1 syncs to Azure AD = Yes
* User2:
* Is not a member of any group.
* The Group1-based filtering excludes non-members, even though OU1 is selected. # User2 syncs to Azure AD = No
* Group2:
* Is a member of Group1, but nested groups are ignored in Azure AD Connect group-based filtering.
* Thus, Group2 itself and its members will not be synchronized. # Group2 syncs to Azure AD = No Based on the exhibits: Evaluating Each Object: Supporting Microsoft Documentation (from SC-300 material):
"When you use group-based filtering, only objects that are direct members of the specified group are synchronized. Nested group memberships are ignored."
"If you select specific OUs for synchronization, objects must meet both the OU filtering and the group filtering criteria to be included in the sync."

Explanation:
Statements
Answer
On February 5, 2021, User1 can answer the Review1 question again.
No
On January 25, 2021, User2 can answer the Review1 question again.
No
On January 22, 2021, User3 can answer the Review1 question.
Yes
This question examines understanding of Access Reviews in Azure Active Directory (Azure AD) as covered in the Microsoft SC-300 Identity and Access Administrator Study Guide and the Microsoft Learn module
"Plan, implement, and manage access reviews."
Here are the key facts from the scenario:
* The access review Review1 starts on January 15, 2021.
* The frequency is set to Monthly, and the duration is 14 days.
* The review ends on February 15, 2021.
* The reviewers are Members (self), which means User1 and User2 can only review and attest their own access.
* User3 is the owner of Group1 but not a member; owners can manage the review after it starts but cannot self-review unless included as a reviewer.
From the configuration and Microsoft documentation:
"When an access review is active, users designated as reviewers can submit their decisions only during the review period. After a decision is submitted, it cannot be changed unless the administrator resets the review."
# Explanation per statement: 1# # On February 5, 2021, User1 can answer the Review1 question again:
User1 already answered on January 17, 2021 ("Yes"). Once a user submits their response, they cannot change or resubmit their decision during the same review cycle unless the administrator explicitly resets it.
# Answer: No
2# # On January 25, 2021, User2 can answer the Review1 question again:
User2 responded "No" on January 20, 2021, within the active review window (January 15-29). After submitting, responses are locked. User2 cannot answer again unless the review is restarted.
# Answer: No
3# # On January 22, 2021, User3 can answer the Review1 question:
The review is configured for Members (self), meaning only group members (User1 and User2) can attest their access. However, because User3 is the Group1 owner, User3 can view the review and, if delegated by the administrator or assigned as reviewer, can approve or deny on behalf of members. Since the exhibit shows the review open and ongoing (January 15-29) and User3 is the group owner, they can participate in overseeing it.
# Answer: Yes

Explanation:
According to the Microsoft SC-300: Identity and Access Administrator Official Study Guide and Microsoft Learn module "Configure Azure AD Multi-Factor Authentication settings", the Ac count Lockout settings in Azure AD MFA define how the service reacts to repeated failed MFA verification attempts.
From the exhibit:
* Number of MFA denials to trigger account lockout: 3
* Minutes until account lockout counter is reset: 60
* Minutes until account is automatically unblocked: 30
1. Lockout trigger type:
The lockout applies to MFA denials - specifically, failed verification attempts using methods such as the Microsoft Authenticator app (OTP code) or phone call verification. It does not apply to incorrect usernames or passwords, as those are handled by Azure AD sign-in risk policies.
The official Microsoft documentation states:
"Account lockout in Azure AD Multi-Factor Authentication occurs after the configured number of denied MFA verification attempts. This setting applies to users entering an incorrect PIN or app verification code." Therefore, after three incorrect Microsoft Authenticator app codes, the account is temporarily locked.
2. Lockout duration:
The setting "Minutes until account is automatically unblocked: 30" means that once an account is locked due to too many failed MFA attempts, it will automatically unlock after 30 minutes without administrator intervention.
This aligns with Microsoft's MFA service behavior:
"When the account lockout threshold is reached, the account remains locked for the configured duration before being automatically unlocked."
# Final Correct Answers:
* Wrong input type causing lockout: Microsoft Authenticator app code
* Unlock duration: 30 minutes

According to the Microsoft SC-300: Identity and Access Administrator study materials and Microsoft Defender for Cloud Apps documentation, connecting third-party cloud applications such as GitHub, AWS, and Google Workspace to Defender for Cloud Apps allows the administrator to monitor user activities and OAuth app authentications in those external services.
The App connectors feature within Microsoft 365 Defender / Microsoft Defender for Cloud Apps provides deep visibility into sanctioned cloud applications by integrating their APIs. When an app connector is added
- such as the GitHub app connector - Defender for Cloud Apps begins ingesting audit logs, including OAuth authorization events, sign-in attempts, and token consent grants.
The relevant Microsoft documentation states:
"App connectors use APIs from connected apps to extend visibility and control to cloud services, enabling monitoring of OAuth application authorizations and security activities." Since the question specifically asks to monitor OAuth authentication requests, adding the GitHub app connector fulfills this requirement because it brings OAuth consent and token data from GitHub into Microsoft 365 Defender (via Defender for Cloud Apps).

The scenario describes users receiving unexpected MFA prompts - a clear indication of a potential MFA fatigue attack (attackers repeatedly send MFA requests hoping users approve one).
To mitigate this, Microsoft documentation recommends enabling automatic blocking of users when they report fraudulent MFA requests.
This can be configured in the Azure portal # Azure AD # Security # MFA # Fraud alert # Block/unblock users settings.
When you enable this setting:
* Users can report "I didn't initiate this request" in the Microsoft Authenticator app.
* Azure AD automatically blocks their account for MFA until an administrator reviews and unblocks it.
From Microsoft Learn ("Configure Azure AD Multi-Factor Authentication fraud alerts"):
"When users report a fraudulent authentication attempt, you can automatically block their account from future sign-ins until an administrator unblocks them." Therefore, configuring the Block/unblock users settings directly meets the goal.