Explanation:
Feature: An MFA registration policy
Grace period: 14 days
According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn documentation under "Plan, implem ent, and manage multifactor authentication (MFA)" , when an organization wants to require users to register for multi-factor authentication methods (such as Microsoft Authenticator, phone number, or email), this is managed through the MFA registration policy within Azure AD Identity Protection.
This feature is called "Combined security information registration" or MFA registration policy, and it allows administrators to enforce users to register for MFA and Self-Service Password Reset (SSPR). The policy defines which users are required to register and sets a grace period - the amount of time a user can postpone registration after first being prompted.
From the Microsoft official exam reference:
"The MFA registration policy allows users to postpone registration for a defined grace period. The default and maximum supported value is 14 days." During the grace period, users can skip the registration prompt but will be reminded every time they sign in until they complete registration or the grace period expires. Once the 14-day period ends, users must register their authentication methods before accessing resources.
Therefore, based on Microsoft's SC-300 study materials and Azure AD documentation:
* The correct feature used to enforce this is An MFA registration policy.
* The standard and maximum grace period before users must complete registration is 14 days.

Implementing Pass-through Authentication (PTA) ensures that Azure AD delegates the authentication process directly to the on-premises Active Directory in real-time. When a user signs in, Azure AD routes the authentication request through a secure channel to the on-premises Authentication Agent, which verifies credentials against AD.
If a user account is disabled in Active Directory, authentication immediately fails because the request is validated directly against the on-premises domain controllers - there's no delay or dependency on synchronization intervals.
From Microsoft documentation (SC-300 official guide):
"Pass-through Authentication provides real-time authentication directly against on-premises Active Directory.
If an account is disabled on-premises, authentication requests are denied immediately." Thus, enabling PTA satisfies the requirement for immediate blocking of disabled accounts.
# Correct Answer: A. Yes

Explanation:

In the SC-300 coverage of Azure AD Connect and Identity Governance, Microsoft explains that to surface a custom on-premises attribute in Azure AD you must enable Directory extensions in Azure AD Connect. The guide states that "Directory extensions lets you synchronize additional attributes from on-premises Active Directory to Azure AD so they are available in the cloud directory for apps and policy." This is the supported way to bring a custom attribute (here, LWLicenses) from the litware.com forest into Azure AD so it can be referenced by cloud features such as dynamic group rules. Domain filtering or optional features do not expose a new attribute to Azure AD; directory extensions does.
For license automation, the SC-300 materials on group-based licensing and dynamic groups emphasize that
"licenses can be assigned to Azure AD groups; group members then inherit the licenses, and when membership changes, licenses are added or removed automatically." They further note that "dynamic user groups evaluate rules against user attributes to add or remove users without manual effort," and that "nested groups are not supported for license inheritance-only direct members receive licenses." Using the synced LWLicenses attribute in a Dynamic User group rule (for example, user.extensionAttribute... -eq "E5") ensures users are automatically added to the correct group and therefore receive the specified licenses without administrative intervention, fully meeting Litware's requirement to "manage the assignment of Azure AD licenses by modifying the value of the LWLicenses attribute."

Explanation:
User
Portal to Use
User1
Azure Active Directory admin center
User2
Microsoft 365 compliance center
User3
Microsoft Endpoint Manager admin center
This question tests your knowledge of Microsoft 365 administrative roles and their associated management portals, as defined in the Microsoft Identity and Access Administrator (SC-300) Exam Study Guide and Microsoft Learn's "Manage identity and access in Microsoft Entra ID and Microsoft 365" module.
Let's analyze each user and the roles assigned:
* Roles:
* User Administrator
* Device Administrator
* Identity Governance Administrator
User1 These are all Azure AD-based roles.
* The User Administrator role allows the management of users, groups, and password resets in Azure AD.
* The Device Administrator role applies to Azure AD joined devices.
* The Identity Governance Administrator manages Access Reviews, Entitlement Management, and Terms of Use, all of which are under Azure AD Identity Governance.
According to Microsoft documentation:
"User, Device, and Identity Governance Admin istrators perform their management tasks in the Azure Active Directory admin center." Portal: Azure Active Directory admin center
* Roles:
* Records Management
* Quarantine Administrator
User2 These are Microsoft Purview compliance roles, used for managing retention policies, data lifecycle management, and quarantine of messages/files.
Both are managed through the Microsoft 365 compliance center (previously known as the Security & Compliance Center). Microsoft documentation:
"Records Management and Quarantine A dministrator roles allow access to compliance features such as data retention, auditing, and message quarantine, all of which are configured from the Microsoft 365 compliance center." Portal: Microsoft 365 compliance center
* Roles:
* Endpoint Security Manager
* Intune Role Administrator
User3 These roles are directly tied to Microsoft Endpoint Manager (Intune).
* The Endpoint Security Manager configures device compliance, security baselines, and endpoint protection.
* The Intune Role Administrator manages Intune roles and permissions.
Microsoft documentation:
"Administrators managing Intune roles and endpoint security policies use the Microsoft Endpoint Manager admin center (https://endpoint.microsoft.com)." Portal: Microsoft Endpoint Manager admin center

SC-300 distinguishes user risk from sign-in risk. The text defines: "User risk is the probability that an identity is compromised," and lists its core detections, including " Leaked credentials detected on public or dark-web sources." By comparison, impossible/anomalous travel and anonymous IP are cited as sign-in risk detections:
"Sign-in r isk is calculated per authentication event using detections such as impossible travel, atypical travel, and anonymous IP address ." Therefore, among the options, only leaked credentials is a user risk detection type; the others are sign-in risk indicators used at authentication time. SC-300 also ties user risk to Identity Protection policies that can require password change or block access when a user's credentials are suspected to be compromised.