The SC-300 curriculum emphasizes synchronization behavior between on-premises Active Directory (AD) and Microsoft Entra ID using Microsoft Entra Connect. By default, directory synchronization occurs every 30 minutes, which means a user dis abled in AD can still authenticate to Microsoft Entra for up to 30 minutes until the next synchronization cycle.
The proposed solution- Microsoft Entra Password Protection -is not related to authentication delay or sign-in blocking. Password Protection enforces strong password policies and prevents the use of weak or compromised passwords during account creation or reset. It does not control sign-in states or enforce real- time disablement.
To meet the goal of immediately blocking authentication when an a ccount is disabled in AD, you must implement Microsoft Entra Connect with Pass-through Authentication (PTA) or federation (AD FS) .
These options validate sign-ins against the on-premises AD in real time, ensuring instant blocking of disabled accounts.
Micr osoft documentation confirms:
"Password Protection does not affect authentication latency or synchronization frequency. To ensure disabled accounts cannot sign in, use Pass-through Authentication or federation for real-time validation."

Explanation:
User1 can use self-service password rese t (SSPR) to reset his password: Yes If User1 accesses Microsoft Exchange Online, he will be authenticated by an on-premises domain controller: Yes User2 can be added to a Microsoft SharePoint Online site as a member: No Based on Microsoft's SC-300 Study Guide , Exam Ref SC-300: Microsoft Identity and Access Administrator
, and Azure AD documentation, Azure AD Connect synchronization is governed by OU filtering, authentication method, and synchronization scope.
In this configuration, Azure AD Connect is set to "Sync selected domains and OUs," and only OU1 is selected. Therefore, only objects (users, groups, etc.) located in OU1 are synchronized to Azure AD.
* User1 (in OU1) is synchronized to Azure AD. Since password writeback is enabled (as seen in the configuration "Enable password writeback"), User1 can perform Self-Service Password Reset (SSPR) from Azure AD, and the change will write back to on-premises AD. Hence, the first statement is Yes.
* Pass-through authentication is also enabled in the configuration ("Enable Pass-through authentication").
With PTA, when User1 accesses Microsoft 365 services (like Exchange Online), the authentication request is forwarded from Azure AD to an on-premises domain controller via the PTA agent. Therefore, authentication is handled by the local AD DS. Hence, the second statement is Yes.
* User2 (in OU2) is not synchronized, as OU2 was not selected in the Domain/OU filtering configuration.
This means User2 does not exist in Azure AD and cannot be granted access to Microsoft 365 resources, including SharePoint Online. Hence, the third statement is No.
This logic aligns with Microsoft documentation under "Configure filtering for Azure AD Connect," which states:
"Only objects from selected domains and organizational units are synchronized. Users outside selected OUs are excluded from Azure AD and cannot authenticate or access cloud resources."

In Microsoft Entra ID (Azure AD), the per-user device cap is controlled in Devices > Device settings. The SC-
300 materials describe that administrators can configure "Users may join devices to Azure AD" and the
"Maximum number of devices per user" . The guide notes that this limit defaults to five and is used to
"control how many devices a user can join or register in Azure AD"; when users reach the limit, "they cannot add additional devices until the limit is increased or an existing device is removed." For scenarios like field or sales staff who use multiple devices, the study content recommends adjusting this value to meet business needs. Because A. Datum's sales users hit the current cap and a requirement states "Increase the maximum number of devices that can be joined or registered to Azure AD to 10," the fix is to change the tenant's Device settings-not User settings, Access reviews, or Security defaults. This aligns with the exam objective to configure device settings for Azure AD join and registration and addresses the precise symptom reported by users.

This question asks you to apply the stated Technical Requirements for Self-Service Password Reset (SSPR) to complete the form. The specific scenario about " User3 " is a distraction, as the configuration applies to all users.
The relevant technical requirements are:
* " Users must provide one authentication method to reset their password by using SSPR. "
* This directly dictates the value for the Number of authentication methods required , which is 1
.
* " Available methods must include: Email, Phone, Security questions, The Microsoft Authenticator app "
* This lists all the options that are configured to be available for SSPR, which determines the value for Authentication methods that can be used : Email , Phone , Security questions , The Microsoft Authenticator app .

Explanation:

The SC-300 materials on Dynamic membership rules for groups specify that user attributes can be evaluated with comparison operators such as -eq, -ne, -match, -notIn, etc. For attributes that may be unset, the documentation explains that you can compare the attribute to the literal null to target users with no value. The guide's rule syntax section states that for string attributes like user.department, "to include users where an attribute has no value, compare the attribute to null (for example, (user.department -eq null) )." It further clarifies that quoted strings (for example, " null " ) are treated as the literal word null , not as the absence of a value, and that $null is not used in Azure AD dynamic rule syntax. Because the requirement is to include all users that do not have a department defined, the correct expression is to select users where the department attribute is empty/unset, which is achieved with the equals operator against null . Therefore, the completed rule is (user.department -eq null) , which adds only those users whose profile has no Department value.