According to Microsoft's identity and access documentation for Conditional Access and phishing-resistant MFA, phishing-resistant MFA methods are those that cannot be socially engineered or replayed. These are Windows Hello for Business, FIDO2 security keys, and certificate-based authentication (CBA) when configured for multi-factor (e.g., smart card with PIN + certificate).
The SC-300 materials highlight that these are the only methods that fully meet NIST AAL3 phishing resistance requirements. Voice calls, SMS, email OTP, and Microsoft Authenticator are not phishing-resistant because they can be intercepted or phished.
Therefore, when building a Conditional Access policy to secure administrative access, you must allow only phishing-resistant methods to meet Microsoft's best practice.

Explanation:
Box 1 =
SigninLogs
| where ResultType == 0
| summarize login_count = count() by identity
| render piechart
This query retrieves the sign-in logs, filters the successful sign-ins,summarizesthe count of sign-ins per user, and renders the result as a pie chart.
Box 2 = Render
In Microsoft Entra ID (Azure AD), the SigninLogs table in Azure Monitor Logs (Log Analytics workspace) contains data about user sign-ins. When you want to query and graphically display the number of sign-ins per user, you use Kusto Query Language (KQL) - the same language that powers Log Analytics, Azure Monitor, and Microsoft Sentinel.
The correct syntax must first aggregate the data and then visualize it:
* where ResultType == 0 filters for successful sign-ins (since 0 indicates success).
* summarize login_count = count() by Identity aggregates (counts) all sign-in events per user (Identity field). The summarize operator in KQL is specifically used to group and aggregate data.
* render columnchart graphically displays the summarized results as a column chart. The render operator is used to visualize query output in supported formats such as timechart, piechart, or columnchart.
Therefore, the correct operators to fill in are:
* First blank: summarize
* Second blank: render
According to the Microsoft SC-300 Study Guide and Microsoft Learn module "Query and visualize sign-in logs with Kusto Query Language", the recommended method to display sign-in frequency per user is:
"Use the summarize operator to aggregate sign-in counts by user, followed by render to visualize results."
# Final Query Answer:
SigninLogs
| where ResultType == 0
| summarize login_count = count() by Identity
| render columnchart

According to Microsoft Defender for Cloud Apps documentation and the SC-300 study guide, an OAuth app policy monitors third-party applications that request access to Microsoft 365 data through Microsoft Graph API permissions. These apps can request delegated or application permissions. When an app is authorized by many users and requests high permissions such as Calendars.ReadWrite , it can introduce security risks.
Defender for Cloud Apps allows administrators to create OAuth app policies to generate alerts when an app:
* Requires high permissions (e.g., read/write to mailboxes, calendars, or files).
* Is authorized by more than a specified number of users (for example, more than 20).
This matches the requirement in the question exactly. Other policy types (anomaly detection, access, or activity) monitor user or session behavior, not app consent behavior.
As per Microsoft's documentation:
"Use OAuth app policies to detect risky OAuth apps, monitor application permissions, and alert when apps are authorized by an unusual number of users or request excessive permissions."

Explanation:
User1 can perform an access review for User1: No
User1 can perform an access review for Managed2: Yes
User1 can perform an access review for User3: Yes
In this scenario, an access review named Review1 has been configured for Group1, with the following conditions:
* Review scope: Teams + Groups
* Group: Group1
* Scope: All users
* Reviewers: Group owner(s)
* Fallback reviewers: None
From the configuration, the reviewers of the access review are the owners of Group1 - namely User1 and User4. Therefore, both of these users are authorized to review all members of Group1.
Group1 includes the following members:
* User1 (User, also owner)
* Managed2 (Managed identity)
* Group2 (which includes User3)
Since the scope is set to All users, it includes both internal and external members. However, the SC-300 materials emphasize that reviewers cannot review their own access; Microsoft Learn states:
"Reviewers cannot approve or deny their own access in an access review, even if they are members of the group under review." Therefore:
* User1 cannot review themselves # No
* User1 can review Managed2 # Yes, because Managed2 is a member of Group1
* User1 can review User3 # Yes, because User3 is a member of Group2, and Group2 is itself a member of Group1, meaning User3's membership is indirectly part of the review scope This behavior aligns with SC-300 guidance that nested group members are included when the review scope is
"All users," and reviewers (owners) can assess all included members except themselves.

Explanation:
According to the Microsoft SC-300 Study Guide, Exam Ref SC-300, and Microsoft Entra External Collaboration (B2B) documentation, the configuration of External collaboration settings in Azure AD determines how guest users can access directory data and who can invite them into the tenant.
Let's analyze each requirement in context:
Requirement 1: "Guest users must be prevented from querying staff email addresses." To achieve this, Azure AD provides the setting Guest user access restrictions, which defines what a guest can see in the directory. The most restrictive setting ensures that guest users can only see their own profile details and no other users or groups.
# Therefore, select:
"Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)." This prevents guests from discovering internal directory data such as email addresses of staff members or group memberships.
Requirement 2: "Guest users must be able to access the tenant only if they are invited by User1." User1 has the User Administrator role. This role is included among the "specific admin roles" allowed to invite guest users when the setting is configured appropriately.
To meet the requirement that only User1 (or other admins) can invite guests, you must configure:
# "Only users assigned to specific admin roles can invite guest users." This restricts invitation privileges to admin roles (such as Global Administrator, User Administrator, etc.) and prevents ordinary users or guests from inviting others.
Requirement 3: "Guests should not be able to self-enroll."
Azure AD B2B allows self-service sign-up through user flows (Identity Experience Framework). Enabling this feature would let external users sign up themselves - which violates the condition that guests must be invited by User1 only.
# Therefore, set Enable guest self-service sign-up via user flows = No.
Final Configuration Summary: Setting
Value
Guest user access restrictions
Guest user access is restricted to properties and memberships of their own directory objects (most restrictive) Guest invite restrictions Only users assigned to specific admin roles can invite guest users Enable guest self-service sign-up via user flows No
# Microsoft Official Documentation Reference (SC-300 Content):
"To prevent guests from seeing other users in the directory, configure guest user access restrictions to 'most restrictive.' To control who can invite guests, use the setting that limits invitations to users with admin roles.
To disallow self-service guest access, disable user flows for external sign-up."