Access reviews require an Azure AD Premium P2 license.
Access reviews for Group1 and App1 can be configured in Azure AD Access Reviews.
Access reviews for the Contributor role and Role1 would need to be configured in Privileged Identity Management (PIM). PIM is included in Azure AD Premium P2.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-start- security-review?toc=/azure/active-directory/governance/toc.json
https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview According to the Microsoft Identity and Access Administrator (SC-300) official study guide and Microsoft Learn training module "Manage Access Reviews", Azure AD Access Reviews allow administrators to periodically evaluate user access to critical resources across Azure AD and Azure.
The exam objectives explicitly list access review capabilities that apply to the following resource types:
Groups (Microsoft 365 or security groups) - Access reviews can be used to ensure that group memberships are up to date. In this case, Group1 is eligible since it has an Assigned membership type, which means access reviews can target its members.
Enterprise applications (App1) - Access reviews can assess users who have access to enterprise applications registered in Azure AD, ensuring that only the right users retain application access.
Azure AD roles (Role1) - Access reviews can be created for privileged directory roles (like Global Administrator or custom roles such as Role1) to validate continued need for elevated permissions.
Azure subscription roles (Contributor) - Access reviews can also be applied to Azure resources and management groups when integrated with Azure AD Privileged Identity Management (PIM). This ensures least-privilege access by reviewing roles like "Contributor." Therefore, based on Microsoft documentation:
"Access reviews can be configured for Azure AD groups, enterprise applications, Azure AD roles, and Azure resource roles to ensure that access rights remain appropriate." This means all four - Group1, App1, Contributor, and Role1 - are supported targets for access reviews.

According to the Microsoft SC-300 Study Guide and Microsoft Defender for Cloud Apps documentation, an access policy in Microsoft Defender for Cloud Apps (MCAS) enables administrators to enforce real-time session control and conditional access based on user risk or session context. These policies integrate directly with Azure AD Conditional Access and Microsoft Defender for Identity signals to determine when a user's session should be allowed, monitored, or blocked.
The documentation specifies:
"Access policies are used to control user access and session activities in real-time. You can use these policies to block access, require session control, or limit downloads when risk conditions such as 'user risk = high' are detected." In this case, since the requirement is to block access to cloud apps when a user is assessed as high risk, an access policy in Defender for Cloud Apps must be used. Other options are not applicable because:
* OAuth app policy controls permissions granted to third-party apps.
* Anomaly detection policy detects unusual activities but does not block access.
* Activity policy monitors specific user actions within apps.

Explanation:
Server1
On DC1
Azure AD Password Protection has two components: the DC agent (installed on domain controllers) and the proxy service (installed on one or more member servers). The SC-300 materials and Microsoft Identity Governance guidance explain that the proxy service is required when domain controllers do not have direct internet access. The proxy retrieves the password protection policy and custom banned password list from Azure AD over outbound HTTPS and makes it available to DC agents. The documentation further states that you should deploy at least one proxy per forest and two for high availability, and that domain controllers do not need internet connectivity when a proxy is deployed. In this scenario, DCs are explicitly blocked from internet access, so the proxy must be placed on member servers. Both SERVER1 (Application Proxy connector) and SERVER2 (Azure AD Connect) are domain-joined member servers with internet connectivity and are appropriate locations for the AzureADPasswordProtectionProxy service; selecting both provides the recommended redundancy. The custom banned password list is configured in Azure AD at the tenant level (as part of Azure AD Password Protection settings), not on individual servers. Once configured, the policy and list are downloaded by the proxy and enforced by the DC agent during password set or change operations, satisfying the requirement to implement a banned password list for the litware.com forest.

Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and official documentation for Azure AD Identity Protection , the ability to configure and view risk-based policies depends on the administrative roles assigned in Azure AD.
* User Risk Policy Configuration: The user risk policy determines how Azure AD responds when a user's sign-in is determined to be risky. According to the Microso ft Learn documentation:
"Only users assigned the Global Administrator, Security Administrator, or Conditional Access Administrator roles can create and manage risk policies in Azure AD Identity Protection." In the scenario, User3 is the Security Administra tor , which gives full rights to configure both sign-in risk and user risk policies. Although User1 (Conditional Access Administrator) can manage Conditional Access policies, only Security Administrator or Global Administrator can configure the user risk po licy in Identity Protection. Therefore, User3 only can perform this configuration.
* Viewing Risky Users Report: Viewing Identity Protection reports, including risky users , risky sign- ins , and risk detections , can be done by users with the following roles:
"Security Reader, Security Operator, Security Administrator, and Global Administrator can view Identity Protection reports." This means both User3 (Security Administrator) and User4 (Security Operator) can access and view these reports.

SC-300 materials explain that managed identities for Azure resources provide an automatically managed identity in Microsoft Entra ID that apps can use to request tokens, thereby "eliminat[ing] the need to manage credentials" and avoiding secrets in code. They also state that Azure Key Vault is the recommended store for secrets and that apps should access Key Vault by presenting an Entra token from a managed identity rather than an embedded key. For scenarios with multiple virtual machines running the same workload, the guidance highlights user-assigned managed identities: they are created as standalone identities and "can be assigned to one or more instances," which means you grant Key Vault access once to the shared identity and attach it to all VMs. This minimizes administration compared to system-assigned identities (which are tied 1:1 to each VM lifecycle). With this approach, the VMs obtain Entra tokens via the user-assigned managed identity to call Azure resources and to authenticate to Key Vault; the application then retrieves the third-party API secret from Key Vault at runtime. This meets all requirements: secrets are securely stored, no credentials in code, VMs use Entra authentication, and operational effort is reduced by reusing a single identity across the VM fleet.