Defender for Cloud Apps (MCAS) provides Access policies to control sign-in and session access to sanctioned apps based on conditions such as user, device, and location. SC-300 notes that access policies can allow, block, or require additional controls and are evaluated at sign-in, making them appropriate to prevent logons from risky or specific locations. In contrast, Activity policies alert on or govern in-app actions (downloads, sharing) after sign-in, and Anomaly detection policies use heuristics to surface suspicious behavior, not enforce blocking. "Unsanctioning" an app merely flags it and can integrate with firewall/proxy tagging; it does not directly enforce a conditional sign-in block. Therefore, to block Yammer sign-ins from high-risk locations, you create an Access policy in Defender for Cloud Apps targeting Yammer with a condition for the designated high-risk locations and set the action to Block (or require step-up).

Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Entra ID documentation , a break-glass account (also known as an emergency access account) is a cloud-only account that must not depend on any on-premises identity infrastructure, such as Active Directory synchronization or conditional access.
* Location: The break-glass account must be created directly in Azure AD (cloud-only) - not in an on- premises Organizational Unit (OU1 or OU2).
* OU1 syncs with Azure AD, meaning if on-premises synchronization fails or the domain controller is unavailable, accounts in OU1 might not authenticate.
* OU2 doesn't sync at all, so creating the account there wouldn't provide Azure AD access.
Therefore, the only resilient option is Azure AD (cloud-only) to ensure access even if directory sync or on-premises systems are unavailable.
* Role: Microsoft recommends assigning the Global Administrator role to break-glass accounts. This ensures full tenant recovery capability in emergencies such as Conditional Access lockouts or MFA misconfiguration.
* The Billing Administrator or Privileged Role Administrator roles don't provide sufficient rights to recover access or modify Conditional Access settings.
* The Global Administrator role has full control over all Azure AD resources and configuration settings.
Reasoning: Microsoft documentation states:
"Create at least two cloud-only emergency access accounts with the Global Administrator role. These accounts must be excl uded from Conditional Access policies and protected with strong authentication methods."

Explanation:

According to the Microsoft SC-300 Study Guide and Microsoft Learn module: "Manage Microsoft 365 group lifecycles", group expiration policies in Microsoft Entra ID apply only to Microsoft 365 groups (formerly Office 365 groups).
Group expiration is part of lifecycle management for Microsoft 365 services and helps ensure that unused groups are automatically deleted after a defined period unless renewed by the owner.
From the table:
* Group1 (Security) # Cannot be set to expire.
* Group2 (Microsoft 365) # Can be set to expire.
* Group3 (Mail-enabled security) # Cannot be set to expire.
* Group4 (Distribution) # Cannot be set to expire.
Therefore, Group2 only can have an expiration policy applied.
Regarding group lifetime, the Exam Ref SC-300 and Microsoft documentation confirm that the minimum (shortest) group lifetime that can be configured for Microsoft 365 group expiration policies is 30 days.
Microsoft Learn states:
"The group lifetime can be set to 30, 60, 90, 180, or 365 days. The minimum allowed is 30 days." This ensures group owners have sufficient time to renew or manage expiring groups before automatic deletion.

See the Explanation for the complete step by step solution.
Explanation:
To implement additional security checks for the Sg-Executive group members before they canaccess any company apps, you can use Conditional Access policies in Microsoft Entra. Here's a step-by-step guide:
Sign in to the Microsoft Entra admin center:
Ensure you have the role of Global Administrator or Security Administrator.
Navigate to Conditional Access:
Go to Security > Conditional Access.
Create a new policy:
Select + New policy.
Name the policy appropriately, such as "Sg-Executive Security Checks".
Assign the policy to the Sg-Executive group:
Under Assignments, select Users and groups.
Choose Select users and groups and then Groups.
Search for and select the Sg-Executive group.
Define the application control conditions:
Under Cloud apps or actions, select All cloud apps to apply the policy to any company app.
Set the device compliance requirement:
Under Conditions > Device state, configure the policy to include devices marked as compliant by Microsoft Intune.
Set the app protection policy requirement:
Under Conditions > Client apps, configure the policy to include client apps that are protected by app protection policies.
Configure the access controls:
Under Access controls > Grant, select Grant access.
Choose Require device to be marked as compliant and Require approved client app.
Ensure that the option Require one of the selected controls is enabled.
Enable the policy:
Set Enable policy to On.
Review and save the policy:
Review all settings to ensure they meet the requirements.
Click Create to save and implement the policy.
By following these steps, you will ensure that the Sg-Executive group members can only access company apps if they meet one of the specified conditions, either by using a compliant device or a protected client app.
This enhances the security posture of your organization by enforcing stricter access controls for executive- level users.

The Microsoft Entra Terms of Use (ToU) documentation included in the SC-300 curriculum specifies that only PDF files are supported when uploading terms of use documents.
Microsoft Entra ID Premium licenses are required to configure Terms of Use, and when administrators create a new ToU, the upload field explicitly accepts a PDF document format. The PDF ensures consistent formatting across devices and preserves the legal structure of compliance statements.
The guide states:
"The terms of use document must be a PDF file. This en sures consistency in presentation and prevents tampering." Therefore, acceptable format: PDF only - formats such as HTML, DOCX, or RTF are not supported.