In Azure AD, Diagnostics settings control the forwarding of logs (sign-ins, audit logs, and provisioning logs) to external services such as Log Analytics, Event Hub, or Storage accounts. However, they do not control who receives alert notifications.
The SC-300 and Microsoft Learn documentation for Azure AD activity monitoring and alerts specifies that alert recipients are managed through Azure Monitor Alert Rules. These rules define the conditions for generating alerts and the action groups (email, SMS, webhook, etc.) that receive them.
To assign a new security administrator as the recipient, you must modify the action group in Azure Monitor, not the diagnostics settings. Adjusting the diagnostics settings only affects log destinations, not alert routing.
Therefore, modifying diagnostics settings would not meet the goal of redirecting alerts to another user.

In Microsoft Defender for Cloud Apps (MCAS), a Session policy is used to monitor and control user activities in real time when accessing cloud resources through Conditional Access App Control.
The requirement states:
"Prevent users from printing PDF files directly from SharePoint Online." This requires controlling a user's session behavior (e.g., download, print, copy) within a web session - not just detecting or auditing it afterward. According to Microsoft's Identity and Access Administrator training materials:
"Session policies enable real-time monitoring and control of user sessions, allowing you to restrict activities such as printing, downloading, or copying content." By configuring a session policy, administrators can apply real-time controls to prevent printing within SharePoint or Teams sessions while allowing normal view access.
Other options:
* File policy controls data at rest (e.g., classifying or sharing files).
* Activity policy detects historical actions.
* Access policy controls conditions for app access, not user actions.

As outlined in the Microsoft Identity and Access Administrator (SC-300) Official Study Guide and Microsoft Learn - Monitor and Analyze Sign-ins in Azure AD, the Azure AD Sign-ins log retains sign-in events for a limited duration depending on the tenant's licensing tier.
For the default Azure AD Free, Office 365, and Azure AD Premium P1/P2 tiers, the standard retention period for sign-in logs is 14 days. This means that administrators can query, review, or export sign-in data only for sign-ins that occurred within the past 14 days using the Azure portal, Microsoft Graph API, or Azure AD PowerShell.
The documentation specifies:
"Azure AD stores audit and sign-in events for up to 14 days in the Azure portal. For longer retention, you must integrate with Azure Monitor, Log Analytics, or export to a SIEM solution." This information is reinforced in the SC-300 training under the "Implement and monitor identity governance" and "Monitor and troubleshoot Azure AD" modules, which highlight that organizations requiring extended historical data must configure diagnostic settings to forward logs to Azure Log Analytics, Azure Storage, or Event Hubs.
Hence, without additional configuration, Azure AD keeps sign-in logs for 14 days by default - after which they are automatically purged.
# Correct Answer: A. 14 days

According to the Microsoft SC-300: Identity and Access Administrator study materials and Microsoft Learn modules under "Implement and manage Cloud App Security (Microsoft Defender for Cloud Apps)", the Cloud App Discovery feature in Microsoft Cloud App Security (now called Microsoft Defender for Cloud Apps ) is designed to identify and analyze the use of shadow IT - unmanaged or unsanctioned applications accessed by users within the organization.
Cloud App Discovery collects logs from network appliances such as firewalls, proxies, or Secure Web Gateways (SWGs). Administrators upload these logs into Cloud App Security or configure continuous log collection through automatic log uploaders. The service then parses and analyzes the data to detect which external applications are being accessed and which users are using them.
In this scenario, since users authenticate to the firewall with their on-premises Active Directory credentials, the firewall logs will contain user information and the external applications being accessed. By importing these logs into Cloud App Discovery, administrators can generate a detailed list of unmanaged (unsanctioned) external applications and identify the specific users connecting to them.
Microsoft documentation explicitly states:
"Cloud App Discovery analyzes traffic logs to identify all cloud applications used in your organization. It provides information about app usage, users, IP addresses, and risk levels to help you assess shadow IT." Hence, the correct and verified answer - based on official SC-300 curriculum and Azure AD Identity Governance content - is Cloud App Discovery in Microsoft Cloud App Securit