Explanation:
Feature: An MFA registration policy
Grace period: 14 days
According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn documentation under "Plan, implem ent, and manage multifactor authentication (MFA)" , when an organization wants to require users to register for multi-factor authentication methods (such as Microsoft Authenticator, phone number, or email), this is managed through the MFA registration policy within Azure AD Identity Protection.
This feature is called "Combined security information registration" or MFA registration policy, and it allows administrators to enforce users to register for MFA and Self-Service Password Reset (SSPR). The policy defines which users are required to register and sets a grace period - the amount of time a user can postpone registration after first being prompted.
From the Microsoft official exam reference:
"The MFA registration policy allows users to postpone registration for a defined grace period. The default and maximum supported value is 14 days." During the grace period, users can skip the registration prompt but will be reminded every time they sign in until they complete registration or the grace period expires. Once the 14-day period ends, users must register their authentication methods before accessing resources.
Therefore, based on Microsoft's SC-300 study materials and Azure AD documentation:
* The correct feature used to enforce this is An MFA registration policy.
* The standard and maximum grace period before users must complete registration is 14 days.

Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn documentation under "Add and configure custom domains in Microsoft 365", when an organization acquires a new Microsoft 365 tenant, it starts with a default domain such as contoso.onmicrosoft.com . To use a friendly and company-branded domain like contoso.com for email and user principal names (UPNs), administrators must follow a specific sequence of steps to integrate the custom domain into Azure AD
/Microsoft 365.
Step 1 - Register a custom domain name of contoso.com First, register the custom domain in Azure Active Directory. This action adds contoso.com to your tenant and prepares Microsoft 365 to validate ownership.
Step 2 - Create a new TXT record in DNS After adding the domain, Microsoft 365 provides a TXT record to add to your DNS zone (at your registrar or DNS host). This record proves that your organization owns the domain.
Step 3 - Verify the domain name Once the TXT record is published and propagated, return to the Microsoft
365 admin center or use PowerShell to verify the domain. This step confirms domain ownership and completes the domain setup.
Step 4 - Set the domain to primary Finally, after verification, set contoso.com as the primary domain. Doing this ensures that all newly created users automatically receive user principal names (email addresses) ending in @contoso.com .
Microsoft documentation states:
"After verifying ownership of the custom domain, you can set it as the default (primary) domain for new users in Microsoft 365."

Explanation:

In the SC-300 curriculum, monitoring consented third-party apps is covered under Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security). The exam materials describe creating policies that watch OAuth-based applications users authorize against Azure AD and flag excessive permissions. The relevant guidance explains that you can configure a policy to alert when "an OAuth application is granted high-impact permissions," for example when a newly registered or consented app gains read and write access to mail (the Mail.ReadWrite permission). By contrast, Azure AD Identity Protection is focused on User risk and Sign-in risk policies for account compromise, not app consent. Identity Governance addresses access packages and reviews, not OAuth permissions. Microsoft Endpoint Manager "app protection" policies are for MAM/MDM on client apps and do not monitor OAuth consent to Microsoft 365 data. The study path emphasizes using Defender for Cloud Apps to "detect and govern OAuth apps and their permissions," and to trigger alerts when scopes indicating data-write capability are granted. Therefore, to be notified if a user- registered app obtains read/write access to users' email, you configure an OAuth app policy in Microsoft Cloud App Security that matches the permission scope and raises an alert when detected.

Reference:
In Azure AD, when an enterprise application's property "User assignment required" is set to Yes, only users or groups explicitly assigned to that application can sign in or even see it in the My Apps portal. This rule ensures that access to the application is restricted to designated users and groups.
The Microsoft SC-300 Study Guide and Microsoft Learn module "Assign users and groups to an enterprise app" explain that if users are unable to see an enterprise app in their My Apps portal, it is often because they have not been assigned to it while User assignment required = Yes.
Given that:
User assignment required = Yes
The group HRUsers has access to App1 and App2 (but not App3)
The same group should be able to see all three apps
The logical resolution is to assign HRUsers to App3 under Users and groups.
Other options are incorrect because:
B). Change User assignment required to No would make the app visible to all users - violating the requirement that access is restricted.
C). Review User consent permissions only affects delegated API permissions, not visibility.
D). Configure sign-on method affects authentication, not app visibility.
Hence, to ensure the users can view and access App3 , you must assign the HRUsers group to the application in its Users and groups blade.
# Correct Answer: A. From Users and groups, add HRUsers

Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Entra ID documentation , a break-glass account (also known as an emergency access account) is a cloud-only account that must not depend on any on-premises identity infrastructure, such as Active Directory synchronization or conditional access.
* Location: The break-glass account must be created directly in Azure AD (cloud-only) - not in an on- premises Organizational Unit (OU1 or OU2).
* OU1 syncs with Azure AD, meaning if on-premises synchronization fails or the domain controller is unavailable, accounts in OU1 might not authenticate.
* OU2 doesn't sync at all, so creating the account there wouldn't provide Azure AD access.
Therefore, the only resilient option is Azure AD (cloud-only) to ensure access even if directory sync or on-premises systems are unavailable.
* Role: Microsoft recommends assigning the Global Administrator role to break-glass accounts. This ensures full tenant recovery capability in emergencies such as Conditional Access lockouts or MFA misconfiguration.
* The Billing Administrator or Privileged Role Administrator roles don't provide sufficient rights to recover access or modify Conditional Access settings.
* The Global Administrator role has full control over all Azure AD resources and configuration settings.
Reasoning: Microsoft documentation states:
"Create at least two cloud-only emergency access accounts with the Global Administrator role. These accounts must be excluded from Conditional Access policies and protected with strong authentication methods."