Explanation:

In Microsoft Entra Access Reviews, the "Upon completion settings" determine what happens after a review cycle ends - especially what happens when reviewers fail to take action. To automatically remove guest users who were not reviewed (or whose memberships were not approved), you must configure the "If reviewers don't respond" option under the Upon completion settings to "Remove access." The Reviewers and General sections define who conducts reviews and their frequency, while Advanced settings provide notifications and reminders.
From SC-300 content:
"You can specify actions upon completion, such as removing users not reviewed, keeping access unchanged, or approving all. The 'Upon completion settings' section controls this behavior."

According to the Microsoft Identity and Access Administrator (SC-300) Official Study Guide and the Microsoft Learn module "Manage Enterprise Applications in Azure AD", when an organization requires that users request access before being allowed to use a corporate application, the correct configuration is to enable Self-service application access.
In Azure AD, the Self-service settings under an enterprise application allow administrators to specify whether users can request access to the app, who can approve those requests, and whether approvals are automatic or manual. This feature integrates directly with Azure AD Entitlement Management, enabling governance controls around who can request and access applications.
The documentation states:
"To allow users to request access to an enterprise application, you must enable self-service application access and configure the request and approval workflow." By contrast:
* Provisioning (Option B) is used for automatic account lifecycle management within the app, not for user access requests.
* Roles and administrators (Option C) deals with administrative delegation, not access requests.
* Application Proxy (Option D) is for enabling secure remote access to on-premises apps, not access workflows.
Therefore, enabling and configuring the Self-service settings is the required step to meet the requirement that users must request access before using MyApp1.

Explanation:

This scenario is based on the Microsoft Entra (Azure AD) Identity Protection feature, which is a major topic in the SC-300: Microsoft Identity and Access Administrator exam. According to the official study guide and Microsoft documentation:
"A user risk pol icy in Microsoft Entra ID is used to detect when a user account is at risk and to enforce remediation actions, such as requiring the user to change their password on the next sign-in."
* Assignments:
* Include: Group1
* Exclude: Group2
* Sign-in risk: Medium and above
* Access control: Require password change
Given Policy Settings: User Details: User
Group Membership
Risk Level
User1
Group1
High
User2
Group2
Medium
User3
Group1, Group2
High
* User1:
* Included in Group1 (policy applies).
* Not a member of Group2 (not excluded).
* Risk level = High, which is # Medium, meeting policy threshold. # User1 must change their password.
* User2:
* Member of Group2 (excluded).
* Even though their risk level is Medium, exclusion overrides inclusion. # User2 will not be prompted to change their password.
* User3:
* Member of both Group1 (included) and Group2 (excluded).
* Exclusion always takes precedence in Microsoft Entra conditional access and risk policies. # User3 will not be required to change their password.
Analysis:
Official Microsoft SC-300 Source Excerpt: From the Microsoft Identity and Access Administrator Study Guide (Exam Ref SC-300) and Microsoft Learn ("Configure and manage user risk policies"):
"When a user is included in both the include and exclude assignments of a pol icy, the exclude setting takes precedence. Risk policies can enforce password change for users with detected risk levels that meet or exceed the configured threshold."

Explanation:
Server1
On DC1
Azure AD Password Protection has two components: the DC agent (installed on domain controllers) and the proxy service (installed on one or more member servers). The SC-300 materials and Microsoft Identity Governance guidance explain that the proxy service is required when domain controllers do not have direct internet access. The proxy retrieves the password protection policy and custom banned password list from Azure AD over outbound HTTPS and makes it available to DC agents. The documentation further states that you should deploy at least one proxy per forest and two for high availability, and that domain controllers do not need internet connectivity when a proxy is deployed. In this scenario, DCs are explicitly blocked from internet access, so the proxy must be placed on member servers. Both SERVER1 (Application Proxy connector) and SERVER2 (Azure AD Connect) are domain-joined member servers with internet connectivity and are appropriate locations for the AzureADPasswordProtectionProxy service; selecting both provides the recommended redundancy. The custom banned password list is configured in Azure AD at the tenant level (as part of Azure AD Password Protection settings), not on individual servers. Once configured, the policy and list are downloaded by the proxy and enforced by the DC agent during password set or change operations, satisfying the requirement to implement a banned password list for the litware.com forest.