Explanat ion:
In Azure AD Identity Protection, a sign-in risk policy can trigger Conditional Access controls (like MFA) when risky sign-ins are detected.
According to the SC-300 training module "Implement and manage user risk policies" , a sign-in risk is associate d with a specific authentication attempt , for instance, when a user connects from an anonymous IP address , TOR network, or unfamiliar location. To enforce MFA only when such sign-in conditions are detected, administrators must use a sign-in risk policy .
Microsoft states: "Sign-in risk policies can enforce MFA or block access when sign-in risk meets the configured threshold, such as sign-ins from anonymous IPs."

The AWS connector in Microsoft Defender for Cloud Apps is designed t o integrate activity logs, user authentication data, and app permissions granted through OAuth. This connector enables monitoring of OAuth token use, identity federation events, and cross-service authentication.
From the official Microsoft Learn content:
" When the AWS app connector is added, Defender for Cloud Apps collects OAuth activity and permissions information to detect anomalous behavior or excessive app permissions." This fulfills the requirement to monitor OAuth authentication requests from AWS and its associated accounts. Therefore, adding the AWS app connector meets the goal .

In Azure AD access reviews, the Reviewer type determines who gets the review tasks. The SC-300 materials explain that selecting "Members (self)" triggers self-attestation, meaning each user only reviews their own access . The guidance states that when you use Members (self), "each user reviews only their own access," and owners or other people do not receive tasks for others. Your goal is for each department's manager to review their staff's access. For that, the documented reviewer choice is Manager (leveraging the user's manager attribute) and, optionally, fallback reviewers to catch users without a manager value. The exhibits show all requests going to Megan Bowen, which typically occurs when Manager is selected but many users lack a populated manager attribute-thus the tasks fall back to the specified fallback reviewer. Changing the reviewer to Members (self) would not route tasks to managers; it would simply ask every user to attest to their own access, failing the goal of manager-based attestation by department. Therefore, the proposed solution does not meet the requirement.