In Azure AD, user consent and admin consent workflows control which users or administrators can approve access to organizational data requested by applications.
The question states:
* "Users can request admin consent to apps they are unable to consent to: Yes"
* "Who can review admin consent requests: Admin2, User2"
When User1 attempts to add an app that requires consent to access company data, and if that app requires admin consent, the request is routed to those designated as admin consent reviewers. In this case, Admin2 and User2 are listed, but only one has the administrative capability to approve the request.
Based on Microsoft documentation:
"Only users who hold an administrative role such as Global Administrator, Cloud Application Administrator, or Authentication Administrator and are designated as reviewers can grant consent on behalf of the organization." Here, Admin2 holds the Authentication Administrator role - an Azure AD admin-level role - while User2 has no administrative privileges. Thus, Admin2 is the only eligible user to approve the admin consent request.

The requirement specifies that:
* Users must sign in using Microsoft Entra credentials,
* Multi-factor authentication must be out-of-band,
* Password sign-ins must be prevented.
According to Microsoft Learn: "Configure passwordless authentication in Microsoft Entra ID" and the SC-
300 Exam Ref , the two supported passwordless and MFA-capable authentication methods that satisfy these conditions are:
* Microsoft Authenticator app - Supports passwordless sign-in using push notifications, providing both identity verification and multi-factor authentication in a single step.
* FIDO2 Passkey - Enables secure passwordless authentication through hardware security keys or device-bound passkeys that rely on public key cryptography and satisfy MFA requirements when configured properly.
Both methods eliminate password usage entirely and integrate with Microsoft Entra for strong identity assurance.
Windows Hello for Business is passwordless but limited to Windows devices (VM1 is Linux). Temporary Access Pass (TAP) is a bootstrap mechanism for enrolling in passwordless sign-in, not a long-term solution.
SMS authentication, while MFA-capable, still requires passwords for primary authentication and doesn't meet the passwordless requirement.

The exhibit shows Password Hash Synchronization (PHS) enabled and Pass-through Authentication (PTA) enabled. The SC-300 materials clarify that when both PTA and PHS are enabled, Azure AD can fall back to PHS if PTA agents become unavailable. The guidance states that PHS can serve as a backup sign-in method to ensure continuity during on-premises connectivity failures. In this scenario, on-premises connectivity to the internet is lost, so PTA agents cannot process sign-ins. Because PHS is enabled, synchronized users can still authenticate in Azure AD using their synced password hashes.
* User1 is a cloud-only user and authenticates directly in Azure AD-unaffected by on-premises outages.
* User2 is directory-synced; with PTA down, sign-in falls back to PHS, allowing access as long as the hash is present.
* User3 is a guest; guests authenticate in their home directory/IdP, independent of your on-premises environment, so they can still sign in.Therefore, during the outage, all three users (User1, User2, and User3) can sign in to Azure AD, satisfying the behavior described in the SC-300 documentation regarding PHS backup for PTA and guest sign-in independence.

Explanation:

This scenario is based on the Microsoft Entra (Azure AD) Identity Protection feature, which is a major topic in the SC-300: Microsoft Identity and Access Administrator exam. According to the official study guide and Microsoft documentation:
"A user risk pol icy in Microsoft Entra ID is used to detect when a user account is at risk and to enforce remediation actions, such as requiring the user to change their password on the next sign-in."
* Assignments:
* Include: Group1
* Exclude: Group2
* Sign-in risk: Medium and above
* Access control: Require password change
Given Policy Settings: User Details: User
Group Membership
Risk Level
User1
Group1
High
User2
Group2
Medium
User3
Group1, Group2
High
* User1:
* Included in Group1 (policy applies).
* Not a member of Group2 (not excluded).
* Risk level = High, which is # Medium, meeting policy threshold. # User1 must change their password.
* User2:
* Member of Group2 (excluded).
* Even though their risk level is Medium, exclusion overrides inclusion. # User2 will not be prompted to change their password.
* User3:
* Member of both Group1 (included) and Group2 (excluded).
* Exclusion always takes precedence in Microsoft Entra conditional access and risk policies. # User3 will not be required to change their password.
Analysis:
Official Microsoft SC-300 Source Excerpt: From the Microsoft Identity and Access Administrator Study Guide (Exam Ref SC-300) and Microsoft Learn ("Configure and manage user risk policies"):
"When a user is included in both the include and exclude assignments of a pol icy, the exclude setting takes precedence. Risk policies can enforce password change for users with detected risk levels that meet or exceed the configured threshold."

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and the Microsoft Learn module "Implement and manage synchronization for Azure AD" , Azure AD Connect Cloud Sync is the preferred solution when you need to synchronize objects from multiple Active Directory (AD DS) forests without establishing forest trusts .
The scenario specifies that trust relationships must NOT be established between adatum.com and litware.
com , but A. Datum must still sync the AD DS users and groups of litware.com to their existing Azure AD tenant (adatum.com).
The SC-300 training materials clarify:
"Azure AD Connect cloud sync enables syncing from multiple AD forests to a single Azure AD tenant without the need f or forest trusts or a full Azure AD Connect installation in each forest." Unlike staging mode (which provides a standby sync server for failover) or extending the same Azure AD Connect instance to another domain (which requires trust relationships and netw ork connectivity between forests), Azure AD Connect Cloud Sync uses lightweight agents and does not depend on forest trust.
Therefore, to meet the requirement of syncing Litware's AD DS to A. Datum's Azure AD tenant without creating a trust , the correct ch oice is to configure Azure AD Connect Cloud Sync between the Azure AD tenant and the litware.com domain.