According to the Microsoft SC-300: Identity and Access Administrator Study Guide and the Microsoft Learn module "Publish on-premises apps for remote access using Azure AD Application Proxy", Azure AD Application Proxy enables secure remote access to internal, on-premises web applications without requiring VPN access.
In the scenario, App1 is an on-premises application hosted within the Litware network, and the technical requirements specify that it must be securely accessible to both internal and external users - including Fabrikam guest accounts - through Azure AD authentication.
Microsoft's official documentation states:
"Azure AD Application Proxy provides secure remote access to on-premises web applications, integrating with Azure AD for single sign-on (SSO) and conditional access policies." Given that the environment already includes a server (SERVER1) running the Azure AD Application Proxy connector, and that Litware wants to enforce Azure AD Conditional Access and MFA for App1, Azure AD Application Proxy is the correct implementation.
The other options are not suitable:
* A. Policy set in Microsoft Endpoint Manager: Used for device compliance and app management, not for publishing on-premises apps.
* B. App configuration policy in Endpoint Manager: Used for mobile app configuration (e.g., MAM policies), not for access publishing.
* C. App registration in Azure AD: Used for modern cloud or SaaS apps integration, but App1 is on- premises and needs proxy access.
Azure AD Application Proxy

SC-300 teaches that group-based licensing supports security groups and Microsoft 365 groups, with assigned or dynamic user membership. The guide states: "Licenses can be assigned to groups whose members are users
; nested groups aren't processed and devices cannot be licensed ." Applying this to the table: Group1 (Security-Assigned) and Group2 (Security-Dynamic User) are valid; Group4 (Microsoft 365-Assigned) and Group5 (Microsoft 365-Dynamic User) are also valid. Group3 is a Security-Dynamic Device group and therefore ineligible because "device objects do not receive user licenses." Consequently, the Office 365 E5 license can be assigned directly to Group1, Group2, Group4, and Group5 only.

Explanation:
No
No
Yes
a) When you assign a group to an application, only users in the group will have access. The assignment does not cascade to nested groups.
b) Tested in lab, existing owners will be replaced. Also direct assignment (resource owner) is path of least privilege. (replicated in test) c) Application setting 'visible to users' is set to No, then no users see this application on their My Apps portal and O365 launcher.
Reference
According to the Microsoft SC-300: Identity and Access Administrator Study Guide, Azure AD Enterprise Application Self-service configuration determines how users can request access, who approves it, and whether access is automatically granted. Let's analyze each statement based on the exhibits:
* Members of Group3 can access App1 without approval from User1 - NOIn the Group1 exhibit, Group1 contains User1, User4, and Group3. In the App1 Self-Service exhibit, it shows that "Require approval before granting access" is set to Yes, and User1 is designated as the approver. Therefore, even though Group3 members might indirectly be part of Group1, access requests to App1 must still be approved by User1 before being granted.
* After configuring self-service, the owner of Group1 is User1 - NOThe PowerShell command Get- AzureADGroupOwner clearly shows that Admin (not User1) is the owner of Group1. Configuring self- service for an application does not change group ownership; it only defines how access requests are handled. Ownership of Group1 remains with Admin.
* App1 appears in the Microsoft 365 app launcher of User4 - YESIn the App1 Properties exhibit, the
"User assignment required" setting is set to Yes. This means only assigned users (directly or via groups) can see and access the application. Since Group1 is configured as the target group for user assignment and User4 is a member of Group1, User4 will see App1 in their Office 365 app launcher after assignment approval.
This logic follows Microsoft Learn documentation:
"When a user is assigned to an enterprise application (either directly or through group membership), the application appears in the user's Office 365 app launcher once access is granted."

The Cloud App Discovery feature in Microsoft Defender for Cloud Apps (formerly Cloud App Security) is designed to identify and analyze shadow IT-applications being accessed by users that are not managed by IT.
By importing firewall or proxy logs, Defender for Cloud Apps can automatically detect unmanaged external SaaS applications and the users accessing t hem. The study guide specifically states:
"Cloud App Discovery analyzes traffic logs from your firewalls and proxies to identify cloud applications used by your organization and provides visibility into usage and risk levels." Therefore, to identify unmana ged external apps and the users accessing them using firewall logs, Cloud App Discovery is the correct Microsoft tool.

Explanation:
User1 must use multifactor authentication (MFA) when signing in to Microsoft 365 apps. = Yes User2 must use multifactor authentication (MFA) when signing in to Microsoft 365 apps. = Yes User3 must use multifactor authentication (MFA) when signing in to Microsoft 365 apps. = No Comprehensive and Detailed Explanation with all Microsoft SC-300: Identity and Access Administrator documents : = In Conditional Access, enforcement is determined by Assignments # Users or workload identities (which specify who the policy applies to) and Target resources (which specify what apps/resources are protected).
When a policy's Grant control is set to Require multifactor authentication , all identities included in the policy's user assignment scope must perform MFA when accessing the targeted resources. Being a member of multiple groups does not weaken enforcement; if a user is in any included group, the policy applies.
Conversely, users not included in the policy's user assignment scope are not prompted by that policy, even if they hold privileged roles. Holding the Global Administrator role does not automatically force MFA unless the tenant uses Security defaults or a Conditional Access policy targets that admin account or its group.
Applying this to the scenario: Policy1 targets All cloud apps (so the apps side is universal), and-given the group context-its user assignment is scoped to Group1 . User1 (Group1) and User2 (Group1 and Group2) are both in scope and therefore must perform MFA. User3 is only in Group2 ; since Group2 is not within the policy's user assignment, Policy1 does not apply to User3, despite the Global Administrator role. Hence:
Yes for User1, Yes for User2, and No for User3.