According to Microsoft's SC-300: Microsoft Identity and Access Administrator Study Guide and Exam Ref SC-300, the behavior of the sign-in process depends on which authentication methods are enabled for the user or their group. Azure AD supports multiple strong authentication methods, such as Microsoft Authenticator app, FIDO2, and SMS, which can be targeted to specific user groups.
The question specifies that the tenant's configuration enables the following methods:
* FIDO2 # Group2 (Yes)
* Microsoft Authenticator app # Group1 (Yes)
* SMS # Group3 (Yes)
And user membership is:
* User1 # Group1
* User2 # Group2
* User3 # Group3
The key phrase in the question is:
"Sign in to cloud apps by matching a number shown in the app with a number shown on their phone." This specific sign-in experience refers to the number matching feature in the Microsoft Authenticator app.
* Number matching is a security enhancement in Azure AD MFA that requires the user to confirm a sign- in by matching a number displayed on the sign-in screen with the number shown in their Microsoft Authenticator app notification.
* According to Microsoft Learn:
"When using the Microsoft Authenticator app for MFA, users will be prompted to enter or match a number displayed on the screen. This feature strengthens authentication by preventing accidental approvals." Therefore:
* Only User1, who is a member of Group1 (the group enabled for Microsoft Authenticator app), will experience number matching when signing in.
* User2 uses FIDO2, which employs a hardware key or biometric verification - not number matching.
* User3 uses SMS, which involves a one-time passcode (OTP) - again, not number matching.
Hence, only User1 will sign in to cloud apps using number matching.

In Azure AD access reviews, the Reviewer type determines who gets the review tasks. The SC-300 materials explain that selecting "Members (self)" triggers self-attestation, meaning each user only reviews their own access . The guidance states that when you use Members (self), "each user reviews only their own access," and owners or other people do not receive tasks for others. Your goal is for each department's manager to review their staff's access. For that, the documented reviewer choice is Manager (leveraging the user's manager attribute) and, optionally, fallback reviewers to catch users without a manager value. The exhibits show all requests going to Megan Bowen, which typically occurs when Manager is selected but many users lack a populated manager attribute-thus the tasks fall back to the specified fallback reviewer. Changing the reviewer to Members (self) would not route tasks to managers; it would simply ask every user to attest to their own access, failing the goal of manager-based attestation by department. Therefore, the proposed solution does not meet the requirement.

When configuring user consent settings in Azure AD, administrators can allow users to consent to third- party or verified publisher apps. However, to control which apps users can consent to based on their permission levels (for example, only "low impact" permissions), Microsoft provides enterprise application collections.
An enterprise application collection lets administrators group apps and assign consent policies that define what permissions apps can request and what level of user consent is allowed.
From Microsoft documentation:
"You can use enterprise application collections to group apps and assign user consent policies that restrict the permissions users can grant to apps. For instance, you can ensure users can only grant low-impact permissions, even when the app comes from a verified publisher." Other options explained:
* Access package: Used for entitlement management, not app consent.
* Permission classifications: Used to label permissions for administrators' understanding, not enforce user consent behavior.
* Access review: Used for periodic evaluation of access, not consent management.

Explanation:

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and official Microsoft Defender for Cloud Apps documentation (formerly Microsoft Cloud App Security, or MCAS), enabling real-time session-level monitoring-known as session control-requires a structured integration between Azure AD Conditional Access and Microsoft Cloud App Security (MCAS).
Here's the correct sequence and rationale:
* Publish App1 in Azure AD The app must first be registered or published in Azure Active Directory so that it can participate in Conditional Access and App Control integration. Without Azure AD integration, Cloud App Security cannot monitor or enforce policies on the app's traffic.
* Create a Conditional Access Policy with Session Controls In Azure AD Conditional Access, you define the conditions (users, apps, risk levels) and set Session controls # Use Conditional Access App Control (Monitor only / Block download) . This links Azure AD sign-in events to MCAS for real-time monitoring.
* Modify the Connected Apps Settings in Cloud App Security In Microsoft Cloud App Security, navigate to Connected apps > Conditional Access App Control apps and ensure that App1 is connected. This ensures traffic from Azure AD sign-ins can be intercepted for session-level monitoring.
* Create a Session Policy in Cloud App Security Finally, you configure a Session Policy (e.g., monitor file downloads, block uploads, restrict copy/paste, etc.) within Cloud App Security. The session policy enforces the desired controls and visibility in real time when users interact with App1.
This order aligns with Microsoft Learn guidance:
"To monitor user sessions in real time, integrate the app with Azure AD Conditional Access, configure session control, connect the app in Microsoft Cloud App Security, and create session policies."
# Final Order:
* Publish App1 in Azure AD
* Create a Conditional Access policy with session controls
* Modify Connected apps settings for App1 in Cloud App Security
* Create a Session policy in Cloud App Security

Explanation:

Azure Key Vault uses soft delete with a configurable retention period (7-90 days). During this window, deleted objects can be recovered, and if purge protection is enabled, they cannot be purged until the retention period expires. The SC-300 materials describe: "Soft-delete retains keys, secrets, and certificates for the configured retention days. When purge protection is enabled, even users with purge permission cannot permanently delete objects before the retention period ends; objects remain recoverable until expiry." The Key Vault RBAC data-plane roles further clarify capabilities. The guide states: "Key Vault Administrator has full data actions, including recover and purge across keys, secrets, and certificates. Key Vault Contributor manages the vault resource and settings but does not have data-plane permissions to read, delete, purge, or recover objects. Certificates Officer can manage and recover certificates but is not granted purge." Applying this:
* Secret1 was deleted on June 1 from KeyVault2 (retention 10 days, purge protection Disabled). If it hasn' t been purged, it is recoverable any time through June 11. Admin1 (Key Vault Administrator) therefore can recover on June 7.
* Certificate1 was deleted on June 1 from KeyVault1 (retention 15 days, purge protection Enabled).
Purge is blocked until June 16 regardless of role. Additionally, Admin2 (Key Vault Contributor) lacks data-plane purge rights. Hence cannot purge on June 12.
* Admin3 (Key Vault Certificates Officer) also lacks purge permission; with purge protection still in effect, cannot purge on June 14.