According to the Microsoft SC-300: Identity and Access Administrator official study guide and the Microsoft Learn module "Manage user and group licenses in Microsoft Entra ID (Azure AD)", when you need to automatically assign licenses to users based on specific attributes (such as department, location, or a custom attribute like LWLicenses), you should use a Dynamic User Security Group in Azure Active Directory (Entra ID).
In the scenario, Litware wants to:
"Manage the assignment of Azure AD licenses by modifying the value of the LWLicenses attribute. Users who have the appropriate value for LWLicenses must be added automatically to the Microsoft 365 group that has the appropriate license assigned." This requirement directly maps to a Dynamic User security group, which supports dynamic membership rules that automatically include users when their attributes meet defined conditions (for example, user.
extensionAttribute15 -eq "E5"). When a license is assigned to this dynamic group, Azure AD automatically provisions or removes licenses for members based on their attribute values - eliminating manual license management.
Per Microsoft documentation:
"You can assign licenses to a group that has dynamic membership. When a user's attributes change, Azure AD automatically adds or removes them from the group, which updates their license assignments accordingly." Now, analyzing the other options:
* B. An OU (Organizational Unit): Used in on-premises Active Directory, not Azure AD. It cannot manage cloud-based license assignments.
* C. A Distribution Group: Used for email distribution in Exchange Online; cannot be used for license assignment.
* D. An Administrative Unit: Used for scoping administrative permissions, not for license assignment.
Therefore, the only object type that satisfies both the technical and automation requirements is a Dynamic User Security Group.
# Correct Answer: A. A Dynamic User security group

According to Microsoft's identity and access documentation for Conditional Access and phishing-resistant MFA, phishing-resistant MFA methods are those that cannot be socially engineered or replayed. These are Windows Hello for Business, FIDO2 security keys, and certificate-based authentication (CBA) when configured for multi-factor (e.g., smart card with PIN + certificate).
The SC-300 materials highlight that these are the only methods that fully meet NIST AAL3 phishing resistance requirements. Voice calls, SMS, email OTP, and Microsoft Authenticator are not phishing-resistant because they can be intercepted or phished.
Therefore, when building a Conditional Access policy to secure administrative access, you must allow only phishing-resistant methods to meet Microsoft's best practice.

Explanation:

According to the official Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn documentation on "Implement and manage self-service password reset (SSPR)" , configuration of SSPR requires settings in both Azure AD and Azure AD Connect .
* Azure AD Configuration (Password reset blade): In the Azure AD admin center, the Password reset blade includes three primary sections: Properties , Authentication methods , and Registration .
* The Authentication methods section determines which verification methods users can use when resetting their password.
* To meet the requirement that users must respond to a mobile app notification or answer three security questions, you must configure these under Authentication methods . Microsoft documentation explicitly states:
"In the Authentication methods section of the Password reset settings, choose which methods users can use, such as mobile app notification, email, or security questions."
* Azure AD Connect Configuration: When users reset their password in Azure AD or on-premises, synchronization must occur both ways to ensure passwords remain consistent.
* Enabling Password writeback in Azure AD Connect allows password changes made in Azure AD (such as through SSPR) to be written back to the on-premises Active Directory. The study guide confirms:
"Password writeback enables users who change or reset their password in Azure AD to have that new password written back to their on-premises Active Directory." Therefore, to meet both requirements - user verification via mobile app or security questions and password synchronization between cloud and on-premises - the correct configuration is:
* From the Password reset blade: Authentication methods
* From Azure AD Connect: Password writeback

According to Microsoft's SC-300 Exam Guide and Microsoft Learn module: Manage Identity Governance in Azure AD, the removal and lifecycle management of external users (B2B guests) within Azure Active Directory's Entitlement Management are configured through Entitlement management settings under the Identity Governance blade.
In scenarios where external partners (such as Fabrikam) are granted access via access packages, administrators can define lifecycle settings to ensure that when access is no longer required, the users are automatically removed from the directory. The Entitlement Management directory settings control two specific parameters:
* Block external user from signing in to this directory - determines whether external users can still sign in after access expiration.
* Remove external user - enables automatic deletion of the guest account after a specified number of days.
* Number of days before removing external user - defines the delay period (in this case, 90 days).
Microsoft documentation states:
"To automatically remove external users from your directory after access expires, configure the Entitlement management settings. You can set whether to block sign-in and specify how many days after access expiration the user should be removed."

In Azure AD, user consent and admin consent workflows control which users or administrators can approve access to organizational data requested by applications.
The question states:
* "Users can request admin consent to apps they are unable to consent to: Yes"
* "Who can review admin consent requests: Admin2, User2"
When User1 attempts to add an app that requires consent to access company data, and if that app requires admin consent, the request is routed to those designated as admin consent reviewers. In this case, Admin2 and User2 are listed, but only one has the administrative capability to approve the request.
Based on Microsoft documentation:
"Only users who hold an administrative role such as Global Administrator, Cloud Application Administrator, or Authentication Administrator and are designated as reviewers can grant consent on behalf of the organization." Here, Admin2 holds the Authentication Administrator role - an Azure AD admin-level role - while User2 has no administrative privileges. Thus, Admin2 is the only eligible user to approve the admin consent request.