Explanation:

Microsoft Entra ID (Azure AD) supports soft-delete for application objects for 30 days after deletion. The SC-
300 materials explain that administrators can recover deleted applications within 30 days; objects deleted beyond that window become non-recoverable. The guide also distinguishes between the application (app registration) and the service principal (enterprise application): the app registration contains credentials (client secrets/certificates) and app role definitions, while the tenant's service principal contains tenant- specific settings such as assignments and self-service configuration. The study content states that recovery operations restore the deleted application object and its schema (including defined app roles and credentials) if performed within the retention window, whereas tenant-scoped assignments and end-user self-service settings are not guaranteed to be recovered because they are specific to the service principal in the tenant.
Applying this: the apps were deleted April 5 and restoration is attempted April 16, which is inside the 30-day window. However, the exam scenario emphasizes the timing of tenant-side updates in March; App1's updates are older than 30 days by April 16, so it falls outside the reliable recovery period for those settings, while App2-App4 remain within it. For App4, the restorability applies to the application object contents- app roles and the client secret-not the tenant-specific Users and groups assignments or Self-service configuration. Hence: Apps = App2, App3, and App4 only; App4 settings = App roles and Client secret only.

In Microsoft Entra Access Reviews, the "Upon completion settings" determine what happens after a review cycle ends - especially what happens when reviewers fail to take action. To automatically remove guest users who were not reviewed (or whose memberships were not approved), you must configure the "If reviewers don't respond" option under the Upon completion settings to "Remove access." The Reviewers and General sections define who conducts reviews and their frequency, while Advanced settings provide notifications and reminders.
From SC-300 content:
"You can specify actions upon completion, such as removing users not reviewed, keeping access unchanged, or approving all. The 'Upon completion settings' section controls this behavior."

SC-300 materials explain that managed identities for Azure resources provide an automatically managed identity in Microsoft Entra ID that apps can use to request tokens, thereby "eliminat[ing] the need to manage credentials" and avoiding secrets in code. They also state that Azure Key Vault is the recommended store for secrets and that apps should access Key Vault by presenting an Entra token from a managed identity rather than an embedded key. For scenarios with multiple virtual machines running the same workload, the guidance highlights user-assigned managed identities: they are created as standalone identities and "can be assigned to one or more instances," which means you grant Key Vault access once to the shared identity and attach it to all VMs. This minimizes administration compared to system-assigned identities (which are tied 1:1 to each VM lifecycle). With this approach, the VMs obtain Entra tokens via the user-assigned managed identity to call Azure resources and to authenticate to Key Vault; the application then retrieves the third-party API secret from Key Vault at runtime. This meets all requirements: secrets are securely stored, no credentials in code, VMs use Entra authentication, and operational effort is reduced by reusing a single identity across the VM fleet.

Explanation:
< Authentication by the domain controller: Pass-through authentication
SSPR: Password writeback
As per the Microsoft Identity and Access Administrator (SC-300) official study guide and Microsoft Learn documentation for Azure AD Connect, the scenario involves two key requirements:
* User sign-ins to Azure AD must be authenticated by an Active Directory domain controller.
* In Azure AD hybrid identity configurations, there are three main authentication methods:
* Password hash synchronization (PHS): Azure AD verifies the password hash stored in the cloud.
* Pass-through authentication (PTA): Authentication requests are passed from Azure AD to on-premises domain controllers using an agent, ensuring that the on-premises AD performs the actual verification.
* Federation with AD FS: Redirects authentication to Active Directory Federation Services.
Since the requirement specifies that authentication must occur by an Active Directory domain controller, Pass- through authentication (PTA) is the correct option. This method ensures the user ' s password validation happens directly against the on-premises domain controller, not the cloud.
* Active Directory domain users must be able to use Azure AD self-service password reset (SSPR).
* To allow users to reset their passwords in Azure AD and have those changes synchronized back to on-premises Active Directory, the Password writeback feature must be enabled in Azure AD Connect.
* This feature securely writes password changes from Azure AD (including SSPR actions) back to the on-premises AD DS environment.
From Microsoft's official text:
"To enable users to reset their on-premises passwords through Azure AD SSPR, enable the Password writeback feature in Azure AD Connect." Therefore, based on Microsoft SC-300 documentation:
* Authentication by the domain controller: Pass-through authentication
* SSPR: Password writeback

A Data Collection Rule (DCR) in Azure Monitor defines what data is collected , where it's sent , and how it's transformed before ingestion. It controls log and metric collection , not alert notifications .
Creating or editing a DCR does not change who receives alerts. It only changes the data ingestion pipeline for monitoring and analytics.
Since the goal is to redirect alert emails to a new administrator, modifying or creating a DCR will not achieve that.