Microsoft Entra certificate-based authentication (CBA) allows users to sign in with X.509 certificates. The SC-300 guidance explains that before users can authenticate with on-premises certificates, the tenant must trust the issuing Certificate Authorities: you must "upload and configure the certificate authorities (root and any intermediates) that issue the user certificates," establishing the trust chain used to validate presented certificates. Only after the CA trust is configured can you map certificate fields and define authentication policies. Auto-enrollment (A) is optional operational convenience for issuing certs, not the first tenant configuration step. Azure Key Vault (B) is unrelated to validating client auth certificates. Windows Hello for Business (D) is a separate credential technology and not required for Entra CBA. Therefore, the first action is to add CA1 (and any intermediates) under Certificate Authorities in Microsoft Entra so that certificates issued by CA1 are recognized for sign-in.

From the exhibit and the SC-300 Study Guide (Access Reviews section) , the access review is configured with the reviewer type set to (Preview) Manager, and Megan Bowen as the fallback reviewer.
In Azure AD Access Reviews, when "Manager" is selected as the reviewer type, the system automatically assigns each user's Azure AD-defined manager to review their access. However, if a user does not have a manager assigned in Azure AD, the review task defaults to the fallback reviewer (in this case, Megan Bowen).
Therefore, if all access review requests are going to Megan Bowen, that means users in the tenant do not have managers properly assigned in Azure AD user attributes.
Adding the department managers as fallback reviewers does not solve the issue because the fallback reviewer receives only the reviews for users without a manager, not based on department.
Microsoft documentation states:
"When 'Manager' is selected as the reviewer, the manager property from Azure AD is used. If a user does not have a manager, the fallback reviewer is used. Adding managers as fallback reviewers will not assign reviews based on departments."

According to Microsoft Identity Governance documentation and the SC-300 study guide, entitlement management in Azure AD allows you to manage access to resources like SharePoint Online sites, Teams, groups, and applications through access packages. However, before an access package can be created, the administrator must first define a catalog.
A catalog is the logical container that holds all the resources (such as groups, Teams, and SharePoint sites) that can be made available in access packages. The process for entitlement management begins with catalog creation, followed by adding resources, then creating access packages that assign roles for those resources.
Therefore, the first step to managing Site1 (SharePoint site) and Team1 (Microsoft Teams team) within entitlement management is to create a catalog and add those resources to it.
This aligns with Microsoft documentation, which states:
"Before creating an access package, you must have a catalog that contains the resources to be made available for assignment."

Explanation:
User1 can use self-service password rese t (SSPR) to reset his password: Yes If User1 accesses Microsoft Exchange Online, he will be authenticated by an on-premises domain controller: Yes User2 can be added to a Microsoft SharePoint Online site as a member: No Based on Microsoft's SC-300 Study Guide , Exam Ref SC-300: Microsoft Identity and Access Administrator
, and Azure AD documentation, Azure AD Connect synchronization is governed by OU filtering, authentication method, and synchronization scope.
In this configuration, Azure AD Connect is set to "Sync selected domains and OUs," and only OU1 is selected. Therefore, only objects (users, groups, etc.) located in OU1 are synchronized to Azure AD.
* User1 (in OU1) is synchronized to Azure AD. Since password writeback is enabled (as seen in the configuration "Enable password writeback"), User1 can perform Self-Service Password Reset (SSPR) from Azure AD, and the change will write back to on-premises AD. Hence, the first statement is Yes.
* Pass-through authentication is also enabled in the configuration ("Enable Pass-through authentication").
With PTA, when User1 accesses Microsoft 365 services (like Exchange Online), the authentication request is forwarded from Azure AD to an on-premises domain controller via the PTA agent. Therefore, authentication is handled by the local AD DS. Hence, the second statement is Yes.
* User2 (in OU2) is not synchronized, as OU2 was not selected in the Domain/OU filtering configuration.
This means User2 does not exist in Azure AD and cannot be granted access to Microsoft 365 resources, including SharePoint Online. Hence, the third statement is No.
This logic aligns with Microsoft documentation under "Configure filtering for Azure AD Connect," which states:
"Only objects from selected domains and organizational units are synchronized. Users outside selected OUs are excluded from Azure AD and cannot authenticate or access cloud resources."

Explanation:

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Official Study Guide and Microsoft Learn - Manage Conditional Access policies module, when an administrator creates a Conditional Access policy using the built-in Require password change for high-risk users template, the policy is automatically pre-configured with specific include and exclude assignments.
By default, this template targets "All users" in the tenant because the policy is designed to detect and remediate risky sign-ins or compromised accounts across the entire directory. However, since Azure AD B2B guest accounts and external users often have limited sig n-in scopes and cannot be subjected to organization- specific password policies, Microsoft's security baseline specifically excludes all guest and external users by default.
The intent behind this default configuration is to apply the password change requir ement to internal users while avoiding unnecessary enforcement on guest identities that do not manage credentials within the host tenant.
From the Microsoft Learn - Conditional Access policy templates documentation:
"When you create a policy from the Requi re password change for high-risk users template, the policy is configured to include all users and exclude all guest and external users by default."