In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN.
After an initial two-step verification of the user during enrollment, Windows Hello is set up on the user's device and Windows asks the user to set a gesture, which can be a biometric, such as a fingerprint, or a PIN.
The user provides the gesture to verify their identity. Windows then uses Windows Hello to authenticate users.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods
https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-overview

To evaluate and remediate risks associated with highly privileged accounts across multiple Azure subscriptions tied to one Microsoft Entra tenant, the recommended tool is Microsoft Entra Privileged Identity Management (PIM). PIM allows you to centrally manage, monitor, and govern privileged access to both Azure resources and Microsoft Entra administrative roles, offering features like time-bound eligibility, just-in-time activation, access reviews, and alerts. TheTechTrails+2Microsoft Learn+2 Because the subscriptions are all under a single tenant, PIM can cover all of them (via Azure RBAC and directory roles) without needing separate tools per subscription. Using PIM minimizes administrative overhead because you don't need to manually track or audit each high privilege account-you can enforce policies, schedule reviews, and use automation. Permissions Management (option D) is more about managing entitlements across cloud resources, rather than governing privileged administrative roles. Therefore, PIM is the correct choice.

In Azure AD Identity Protection, risk detections are classified into sign-in risks and user risks . According to Microsoft's SC-300 Study Guide and Identity Protection documentation , a user risk represents the probability that an account has been compromised . Microsoft aggregates multiple sign-in signals and applies its threat intelligence algorithms to determine whether a user's identity may be at risk.
Among the listed options, Password spray , Anonymous IP address , and Unfamiliar sign-in properties are sign-in risk detections , while Azure AD threat intelligence is the only type classified as a user risk detection
.
Microsoft Docs states: "User risk detections are generated by Azure AD threat intelligence when Microsoft detects that user credentials appear to be compromised."

As documented in Microsoft's App governance for Microsoft 365 guidance, App Governance is a security and compliance add-on that provides visibility and policy-based controls over OAuth-enabled applications integrated with Microsoft 365. Once you purchase and assign the app governance license, the integration and management of this feature are performed through the Microsoft 365 Defender portal.
In the Defender portal, administrators navigate to App governance under the Permissions & Apps section to enable integration, view insights, and configure policies. Microsoft documentation states:
"App governance capabilities are surfaced in the Microsoft 365 Defender portal (https://security.microsoft.
com) where you can monitor, alert, and remediate risky app behaviors connected to Microsoft 365 data." Therefore, the integration and monitoring are managed only in Microsoft 365 Defender, not in Azure AD, Purview, or Defender for Cloud Apps.

Explanation:
< User1: User administrator
User2: Reports reader
According to the Microsoft SC-300: Identity and Access Administrator Study Guide and the Exam Ref SC-
300: Microsoft Identity and Access Administrator , Azure AD includes several predefined roles that control delegated administrative permissions in the directory. Access reviews in Azure AD (part of Identity Governance ) can be created and managed by specific roles, dependi ng on their intended task.
The User administrator role is designed for managing users and groups. It allows the user to create and manage access reviews for groups and applications within the organization. This includes the ability to start new reviews, mo dify existing ones, and manage reviewers. Therefore, User1 , who must create access reviews, requires this role.
On the other hand, the Reports reader role is a read-only administrative role that allows viewing of all audit logs, sign-in logs, and reports, including access review history reports . This role cannot create or modify reviews but can access and review the outcomes of completed reviews. Therefore, User2 , who needs to review historical access review reports, should be assigned the Reports reader ro le.
Microsoft Learn's "Manage access reviews in Azure AD Identity Governance" module and the SC-300 Learning Path confirm:
"User administrators can create and manage access reviews for users, groups, and applications. Reports readers can view the access re view results and history reports but cannot create or modify them