The Microsoft Entra Terms of Use (ToU) documentation included in the SC-300 curriculum specifies that only PDF files are supported when uploading terms of use documents.
Microsoft Entra ID Premium licenses are required to configure Terms of Use, and when administrators create a new ToU, the upload field explicitly accepts a PDF document format. The PDF ensures consistent formatting across devices and preserves the legal structure of compliance statements.
The guide states:
"The terms of use document must be a PDF file. This ensures consistency in presentation and prevents tampering." Therefore, acceptable format: PDF only - formats such as HTML, DOCX, or RTF are not supported.

The SC-300 Study Guide section on "Implement Access Reviews" states that administrators can create access reviews for groups, roles, or applications. When the scenario involves verifying external users' access to specific applications - such as the Exchange admin center - the proper configuration is an application- based access review targeting guest users.
Microsoft Learn specifies:
"Application access reviews allow you to periodically verify external users' access to enterprise applications integrated with Azure AD." Since the contractor is an external (guest) user and the access is to a specific application (Exchange admin center), you must configure an application-based review, not a group-based or directory-based one.
# Correct Answer: D. an application-based access review that targets guest users

Per Microsoft SC-300 official study guide and Microsoft Learn module "Manage identities using managed identities", when a web app uses a system-assigned managed identity, Azure automatically creates a service principal representing that identity within Microsoft Entra ID.
To grant the managed identity permission to read and write files in an Azure Storage account, you must configure role-based access control (RBAC) permissions via the Access control (IAM) blade in the Azure portal. Specifically, you would assign roles such as Storage Blob Data Contributor or Storage Blob Data Reader to the managed identity at the appropriate resource scope (e.g., storage account or container).
Other options like SAS tokens, access keys, or File share settings rely on key-based or manual authentication methods, which contradict the principle of least privilege and managed identity automation.
Access control (IAM) ensures secure, identity-based access through Azure AD.
# Correct Answer: B. the Access control (IAM) settings

Explanation:

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/roles/delegate-app-roles

According to the Microsoft SC-300: Identity and Access Administrator Study Guide, the enforcement of Modern Authentication for Microsoft 365 services such as Exchange Online is achieved through Conditional Access policies. Conditional Access allows you to block legacy authentication protocols (such as POP, IMAP, SMTP, and MAPI over HTTP) that use Basic Authentication, and require Modern Authentication (OAuth 2.0) instead.
Microsoft Learn explains that you can configure a policy that "blocks access requests using legacy authentication clients" under Conditions # Client apps and select "Other clients (legacy authentication clients)" to enforce Modern Authentication. Defender for Cloud Apps OAuth policies and Intune app
/compliance policies do not control authentication protocols at the tenant level.