This scenario involves Admin Consent Requests in Azure AD. When users try to use apps that require admin consent , requests are sent to designated reviewers who can approve or deny them.
* Admin1 : Cloud Application Administrator - can review and approve admin consent requests.
* Admin2 : Application Administrator - can review and approve admin consent requests.
* Admin3 : Security Administrator - cannot approve app consent requests because this ro le does not have application management privileges.
* User1 : No role assigned - can be listed as a reviewer but cannot approve , only receive notifications.
From Microsoft Documentation:
"Only users with sufficient permissions, such as the Application Adminis trator or Cloud Application Administrator roles, can grant admin consent in response to consent requests." Therefore, only Admin1 and Admin2 meet the requirement to review and approve.

SC-300 distinguishes user risk from sign-in risk. The text defines: "User risk is the probability that an identity is compromised," and lists its core detections, including " Leaked credentials detected on public or dark-web sources." By comparison, impossible/anomalous travel and anonymous IP are cited as sign-in risk detections:
"Sign-in r isk is calculated per authentication event using detections such as impossible travel, atypical travel, and anonymous IP address ." Therefore, among the options, only leaked credentials is a user risk detection type; the others are sign-in risk indicators used at authentication time. SC-300 also ties user risk to Identity Protection policies that can require password change or block access when a user's credentials are suspected to be compromised.

To detect and get alerts when a user downloads a large number of files in a short period of time (for example, more than 50 files within one minute) in Microsoft SharePoint Online, you must configure an Activity policy in Microsoft Defender for Cloud Apps (MCAS).
* Activity policies monitor specific user actions (upload, download, delete, share, etc.) and can trigger alerts based on thresholds or frequency.
* Anomaly detection policies detect behavioral anomalies automatically (not threshold-based).
* Session policies apply real-time controls during sessions (e.g., block download).
* File policies monitor or classify files at rest.
From Microsoft's documentation:
"Activity policies let you monitor specific activities in your cloud apps and define actions or alerts when certain criteria are met, such as excessive downloads or mass deletions." Thus, for detecting a user who downloads more than 50 files in one minute - an Activity policy is required.

Explanation:
Object type: An administrative unit
Role: Authentication administrator
In Azure AD Identity and Access Administration, Administrative units (AUs) let you scope delegated admin privileges to a subset of users. The study materials describe AUs as a way to "delegate administration to a subset of users by using administrative units," ensuring the support team's privileges apply only to the executives and not tenant-wide. You would place the 100 executives in a dedicated AU and then assign the support team a suitable role scoped to that AU, satisfying least-privilege principles.
For the required tasks-reset passwords and manage MFA settings-the correct least-privileged role is Authentication administrator. The role capabilities are documented as allowing you to "view, set, and reset authentication method information for non-administrators" and to "require users to re-register for MFA," which covers managing MFA settings for the executives. By contrast, Password administrator is limited to
"reset passwords for non-administrators" and does not include managing authentication methods/MFA, and Helpdesk administrator focuses on basic user help tasks and password resets without full MFA method management. Therefore, assigning Authentication administrator scoped to an Administrative unit containing only the executives meets the scenario and adheres to least privilege.

In Azure AD Identity Governance, application access granted through Entitlement management is organized around catalogs and access packages. The SC-300 study materials explain that "a catalog is a container for resources and access packages" and that you must add your enterprise applications (or the groups tied to those apps) to a catalog before you can build access packages that users can request. Creating the catalog first enables you to place only the required resources in scope and to delegate day-to-day ownership: "catalog owners can manage the resources and access packages within their catalog without being tenant-wide admins," satisfying the delegation requirement to use custom catalogs and least privilege. After the catalog exists, you create one or more access packages that include the application (or groups) and policies that control who can request, how they are approved, and for how long. Identity Governance then lets you track access package assignments and review who has the app over time. By contrast, programs are used to group and report on governance initiatives (for example, collections of access reviews) rather than to onboard application resources; and modifying user/admin consent settings affects app consent behavior, not the lifecycle tracking of assignments. Therefore, the correct first step to track application access assignments while meeting the delegation requirements is to create a catalog.