In Azure RBAC, when creating a custom role through the Azure portal, you can only clone from existing roles of the same scope type. Since Role3 is an Azure subscription-level custom role, it can be cloned only from subscription-level roles-either built-in subscription roles (like Owner, Contributor, Reader) or other custom subscription roles.
Azure AD roles (directory roles) cannot be cloned to create subscription roles because they operate at a completely different control plane (Azure AD vs Azure Resource Manager).
Thus, from the given table:
* Role1 = Azure AD role # cannot be cloned.
* Role2 = Azure subscription role # can be cloned.
Therefore, the correct option is C

Azure AD External collaboration settings govern who can bring guests into the tenant. The SC-300 content specifies: "External collaboration settings let you control who can invite guests (Anyone, Members, Guests, or Only admins and users in the Guest Inviter role) and whether guests can invite." It also highlights: "To restrict guest invitations to administrators or designated inviters, configure External collaboration to 'Only admins and users in the Guest Inviter role' and disable guest-to-guest invitations if required." Because the problem states that "Anyone in the organization can invite guest users, including other guests and non- administrators," the remediation is to tighten External collaboration settings so only approved roles (e.g., Global admins, Guest Inviter, or specific administrators) can invite. Access reviews address periodic entitlement verification, Conditional Access enforces sign-in/session policies, and Continuous Access Evaluation relates to token lifetime/signal-based revocation; none of these change who can send guest invitations. Adjusting External collaboration settings directly resolves the issue and aligns with the requirement that "only users that are assigned specific admin roles can invite guest users."

https://learn.microsoft.com/en-us/defender-cloud-apps/access-policy-aad To create a Microsoft Defender for Cloud Apps access policy for App1, you should configure a Conditional Access policy to use app-enforced restrictions. This will allow you to control access to your cloud apps based on conditions such as user, device, location, and app state. You can also use app-enforced restrictions to control access to your cloud apps based on the state of the app, such as whether it's running on a managed or unmanaged device.

See the Explanation for the complete step by step solution.
Explanation:
To ensure that all users can consent to apps that require permission to read their user profile and prevent them from consenting to apps that require any other permissions, you can configure the user consent settings in the Microsoft Entra admin center. Here's how you can do it:
* Sign in as a Global Administrator:
* Access the Microsoft Entra admin center with Global Administrator privileges.
* Navigate to user consent settings:
* Go to Identity > Applications > Enterprise applications > Consent and permissions > User consent settings1.
* Configure the consent settings:
* Under User consent for applications, select the option that allows users to consent to apps that only require permission to read their user profile.
* Ensure that all other permissions are set to require administrator consent, thus preventing users from consenting to apps that require additional permissions1.
* Save the settings:
* After configuring the consent settings, select Save to apply the changes.
By following these steps, you will have configured the system to allow user consent for apps that need to read the user profile while blocking consent for apps that require additional permissions. This setup helps maintain user autonomy where appropriate while safeguarding against unauthorized access to broader permissions.

Explanation:

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and Microsoft Learn's official training on "Manage entitlement management in Azure AD Identity Governance", connected organizations and access package policies determine who can request access packages.
When creating an access package for external users, administrators define connected organizations and then specify who from those organizations is allowed to request access. This configuration is managed through access package policies within Identity Governance. Each policy defines the requestors (users from specific domains or organizations) and approval settings.
To allow access for users who have @fabrikam.com email addresses, the correct step is to configure an access package policy in Identity Governance, specifying that only users whose domain matches fabrikam.com can request access.
However, since Fabrikam also owns another domain ( litwareinc.com ), and you want to block those users from accessing the package, this restriction cannot be configured solely through the access package policy.
The Microsoft documentation clarifies that to block specific external domains from collaborating or being invited into the tenant, administrators must use the External collaboration settings in Azure AD. These settings allow tenant administrators to define which external domains are allowed or denied for guest invitations.
Thus:
* To allow fabrikam.com # configure Access package policy in Identity Governance (to specify who can request the package).
* To block litwareinc.com # configure External collaboration settings in Azure AD (to block invitations or collaboration from that domain).