Explanation:

SC-300 materials stress that to enforce modern controls (like MFA) on on-premises apps, you must front them with Azure AD so Conditional Access can evaluate sign-ins. The documentation states that Azure AD Application Proxy " provides secure remote access to on-premises applications " and that apps published through it can have " Conditional Access policies, including multifactor authentication " applied at sign- in. In other words, once the legacy app is published by Application Proxy, Azure AD sits in the path, enabling you to meet the requirement to enforce MFA when accessing on-premises applications and to combine it with your location-based exemptions.
For SharePoint Online restrictions, SC-300 points to Microsoft Cloud App Security (Defender for Cloud Apps) for real-time governance: you can create session policies that " control and limit activities in real time " and, for SharePoint Online and other Microsoft 365 apps, " monitor user sessions and block download, cut, copy, and print " when conditions (device state, risk, or location) warrant it. Since the scenario already has anomaly detections enabled, configuring Cloud App Security policies aligns directly with the requirement to place access restrictions on SharePoint Online without altering tenant-wide consent settings. Thus, publish on-prem apps with Application Proxy to bring them under Conditional Access (for MFA), and use Cloud App Security policies to enforce SharePoint Online session and download controls.

According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and the Microsoft Learn module "Configure Azure AD Privileged Identity Management (PIM)", Azure AD PIM provides two types of role assignments: Active and Eligible.
An Active assignment means the user permanently holds the role with immediate access. An Eligible assignment means the user can activate the role only when needed, after providing justification or approval.
This follows the least privilege principle by reducing exposure to high-privilege roles.
The official documentation states:
"Users assigned as eligible must activate their role when they need to perform privileged tasks. This ensures that administrative privileges are granted only for a limited time and when necessary." Because all IT users currently have permanent Security Administrator roles, the correct remediation is to change their assignment type from Active to Eligible so they can activate it only when required. Options A and B relate to expiration settings but do not convert the assignment type.

Explanation:

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and official Microsoft Defender for Cloud Apps documentation (formerly Microsoft Cloud App Security, or MCAS), enabling real-time session-level monitoring-known as session control-requires a structured integration between Azure AD Conditional Access and Microsoft Cloud App Security (MCAS).
Here's the correct sequence and rationale:
* Publish App1 in Azure ADThe app must first be registered or published in Azure Active Directory so that it can participate in Conditional Access and App Control integration. Without Azure AD integration, Cloud App Security cannot monitor or enforce policies on the app's traffic.
* Create a Conditional Access Policy with Session ControlsIn Azure AD Conditional Access, you define the conditions (users, apps, risk levels) and set Session controls # Use Conditional Access App Control (Monitor only / Block download). This links Azure AD sign-in events to MCAS for real-time monitoring.
* Modify the Connected Apps Settings in Cloud App SecurityIn Microsoft Cloud App Security, navigate to Connected apps > Conditional Access App Control apps and ensure that App1 is connected. This ensures traffic from Azure AD sign-ins can be intercepted for session-level monitoring.
* Create a Session Policy in Cloud App SecurityFinally, you configure a Session Policy (e.g., monitor file downloads, block uploads, restrict copy/paste, etc.) within Cloud App Security. The session policy enforces the desired controls and visibility in real time when users interact with App1.
This order aligns with Microsoft Learn guidance:
"To monitor user sessions in real time, integrate the app with Azure AD Conditional Access, configure session control, connect the app in Microsoft Cloud App Security, and create session policies."
# Final Order:
* Publish App1 in Azure AD
* Create a Conditional Access policy with session controls
* Modify Connected apps settings for App1 in Cloud App Security
* Create a Session policy in Cloud App Security

Explanation:
< Job title property: # User2 only
Usage location property: # User2 and User3 only
According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and Micro soft Learn documentation on Azure Active Directory user management, the ability to modify user attributes such as Job title and Usage location depends on whether the user is:
* Directory-synced (from on-premises Active Directory), or
* Cloud-only (created directly in Azure AD), or
* Guest (external B2B user)
Here's the explanation for each scenario based on the user table provided:
Name
Type
Directory Synced
User1
Member
Yes
User2
Member
No
User3
Guest
No
* The Job title attribute is read-only for users synchronized from on-premises Active Directory. For directory-synced users like User1, the attribute must be managed in on-premises AD and synchronized via Azure AD Connect.
* For cloud-only users (like User2) and guest users (like User3), the attribute can be modified in Azure AD. However, Microsoft restricts certain profile fields, including Job title, for guest users unless they are given specific permissions.
# Job title property # Therefore, only User2 (a cloud-only member) can have the Job title property configured directly in Azure AD.
* The Usage location property determines licensing restrictions (for example, Microsoft 365 services available by country).
* This property is editable for cloud-only users (User2) and guest users (User3).
* For directory-synced users (User1), the value is controlled from on-premises AD, and cannot be modified in Azure AD.
# Usage location property # Therefore, User2 and User3 can have the Usage location property configured in Azure AD.
* Job title property: User2 only
* Usage location property: User2 and User3 only
# Final Answers:
Reference (Microsoft Official Documentation Extracts):
"For synchronized users, attribute values such as Job title and Department are managed in the on-premises Active Directory and cannot be edited in Azure AD."
"Usage location must be specified in Azure AD for cloud-only and guest users to assign licenses correctly."

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn documentation on Managed Identities for Azure Resources , the recommended and most secure method for an Azure resource (like an App Service) to access another Azure resource (such as an Azure SQL Database) is through Managed Identities.
Managed identities allow Azure services to authenticate securely to other Azure services that support Azure AD authentication, without requiring the use of credentials stored in code, configuration files, or key vaults.
There are two types of managed identities:
* System-assigned managed identity
* Created and tied directly to the lifecycle of a specific Azure resource (e.g., App Service).
* When the resource (App1) is deleted, the identity is automatically deleted as well.
* Best suited when a single resource requires authentication to access another Azure service.
* User-assigned managed identity
* Created as an independent Azure resource.
* Can be assigned to multiple services and managed separately.
* Useful for scenarios requiring shared identity or cross-service authentication management.
* App1 (Azure App Service) must access db1 (Azure SQL Database).
* Credentials should be available only to App1, meaning other resources should not share or reuse the identity.
* Administrative effort should be minimized, implying automatic management of credentials and lifecycle.
Scenario Analysis: Hence, a system-assigned managed identity is the best solution because it meets all three conditions:
* No manual credential management (Azure handles authentication token issuance automatically).
* The identity exists only for App1 (it's unique to that resource).
* Simplified lifecycle - identity is created and deleted automatically with App1.
# Official Microsoft Documentation (aligned with SC-300 exam objectives):
"System-assigned managed identities are ideal for scenarios where a single Azure resource requires access to another Azure service and you want Azure to automatically manage the identity's lifecycle."
"Managed identities eliminate the need for developers to manage credentials in code or configuration files."