In Microsoft Entra ID (Azure Active Directory), creating guest user accounts for external users involves the B2B collaboration invitation process, not the Bulk create user operation. The Bulk create user feature in the Azure portal is used exclusively for creating member users (internal accounts) within your tenant - users that belong directly to your organization.
The Microsoft Azure Administrator official study guide and documentation specify that to onboard external users (guests), you must invite them using the B2B invitation mechanism. This process creates user objects with userType = Guest in your directory. The correct method to achieve this in bulk is by using the PowerShell cmdlet New-AzureADMSInvitation or Microsoft Graph API to send invitations automatically to all external users listed in your CSV file.
Bulk create user operation does not support adding guest accounts because it doesn't generate the B2B invitation link or email, which is required for the external user to accept and authenticate using their own identity provider (e.g., Microsoft account, Google, or another Entra tenant).
Therefore, the proposed solution fails to meet the requirement of creating guest accounts for the 500 external users in the contoso.com tenant. The correct solution would be to use PowerShell with the New- AzureADMSInvitation command or the Azure AD portal's "Invite external users" bulk import option designed specifically for guest creation.

Explanation:

This question tests your understanding of Azure Role-Based Access Control (RBAC) and management group inheritance.
Scenario Breakdown:
MG1 # Management group containing Sub1 and Sub2
Group1 # Assigned Reader role at MG1
# Inherited Reader permissions on Sub1 and Sub2 and all child resources (read-only access).
User1:
Member of Group1 # inherits Reader access via MG1.
Assigned User Access Administrator at MG1 # can manage role assignments across Sub1 and Sub2.
Assigned Virtual Machine Contributor on Sub1 and Sub2.
Assigned Contributor on RG1 (in Sub1).
Statement 1:
"The Group1 members can view the configurations of the Azure functions."
# Yes
The Reader role allows users to view all configurations and metadata of Azure resources, including Azure Functions, but does not allow editing.
Since Group1 has the Reader role at the management group level, this permission cascades down to all subscriptions (Sub1, Sub2) and their resources (including RG1).
# Microsoft Reference:
"Reader: View all resources, but cannot make any changes."
(Source: Azure RBAC built-in roles - Reader)
Statement 2:
"User1 can assign the Owner role for RG1."
# Yes
The User Access Administrator role grants the ability to manage role assignments in Azure RBAC.
Even without Owner permissions, a User Access Administrator can grant any role (including Owner) to others for scopes under their assignment.
User1's User Access Administrator role is assigned at MG1, which includes Sub1, Sub2, and all underlying resource groups (like RG1).
# Microsoft Reference:
"User Access Administrator: Lets you manage user access to Azure resources. It allows assigning or removing any role on the scope." (Source: Azure built-in roles documentation - User Access Administrator) Statement 3:
"User1 can create a new resource group and deploy a virtual machine to the new group."
# No
Although User1 has Contributor and Virtual Machine Contributor roles on Sub1 and Sub2, role inheritance is specific to the assigned scope.
The Virtual Machine Contributor can manage VM resources but cannot create new resource groups.
The Contributor role on RG1 gives full access only within that resource group - not at the subscription level.
To create new resource groups, a user must have Contributor or Owner permissions at the subscription level, which User1 does not have.
# Microsoft Reference:
"Contributor: Grants full access to manage all Azure resources, but does not grant access to assign roles. To create resource groups, the Contributor must be assigned at the subscription level." (Source: Azure RBAC permissions and role scopes)

Cost analysis: Correct Option
In cost analysis blade of Azure, you can see all the detail for custom time span. You can use this to determine expenditure of last few day, weeks, and month. Below options are available in Cost analysis blade for filtering information by time span: last 7 days, last 30 days, and custom date range. Choosing the first option (last 7 days) auditors can view the costs by time span.
Cost analysis shows data for the current month by default. Use the date selector to switch to common date ranges quickly. Examples include the last seven days, the last month, the current year, or a custom date range.
Pay-as-you-go subscriptions also include date ranges based on your billing period, which isn't bound to the calendar month, like the current billing period or last invoice. Use the <PREVIOUS and NEXT> links at the top of the menu to jump to the previous or next period, respectively. For example, <PREVIOUS will switch from the Last 7 days to 8-14 days ago or 15-21 days ago.

Invoice: Incorrect Option
Invoices can only be used for past billing periods not for current billing period, i.e. if your requirement is to know the last week's cost then that also not filled by invoices because Azure generates invoice at the end of the month. Even though Invoices have custom timespan, but when you put in dates for a week, the pane would be empty. Below is from Microsoft document:

Resource Provider: Incorrect Option
When deploying resources, you frequently need to retrieve information about the resource providers and types. For example, if you want to store keys and secrets, you work with the Microsoft.KeyVault resource provider. This resource provider offers a resource type called vaults for creating the key vault. This is not useful for reviewing all Azure costs from the past week which is required for audit.
Payment method: Incorrect Option
Payment methods is not useful for reviewing all Azure costs from the past week which is required for audit.
Reference:
https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/quick-acm-cost-analysis
https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/download-azure-invoice-daily- usage-date

Technically, The finance department needs to migrate their users from AD to AAD using AADC based on the finance OU, and need to enforce MFA use. This is conditional access policy. Employees also often get promotions and/or join other departments and when that occurs, the user's OU attribute will change when the admin puts the user in a new OU, and the dynamic group conditional access exception (OU= [Department Name Value]) will move the user to the appropriate dynamic group on next AADC delta sync.
https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates