According to Microsoft Identity Governance documentation and the SC-300 study guide, entitlement management in Azure AD allows you to manage access to resources like SharePoint Online sites, Teams, groups, and applications through access packages. However, before an access package can be created, the administrator must first define a catalog.
A catalog is the logical container that holds all the resources (such as groups, Teams, and SharePoint sites) that can be made available in access packages. The process for entitlement management begins with catalog creation, followed by adding resources, then creating access packages that assign roles for those resources.
Therefore, the first step to managing Site1 (SharePoint site) and Team1 (Microsoft Teams team) within entitlement management is to create a catalog and add those resources to it.
This aligns with Microsoft documentation, which states:
"Before creating an access package, you must have a catalog that contains the resources to be made available for assignment."

The scenario describes users receiving unexpected MFA prompts - a clear indication of a potential MFA fatigue attack (attackers repeatedly send MFA requests hoping users approve one).
To mitigate this, Microsoft documentation recommends enabling automatic blocking of users when they report fraudulent MFA requests.
This can be configured in the Azure portal # Azure AD # Security # MFA # Fraud alert # Block/unblock users settings.
When you enable this setting:
* Users can report "I didn't initiate this request" in the Microsoft Authenticator app.
* Azure AD automatically blocks their account for MFA until an administrator reviews and unblocks it.
From Microsoft Learn ( "Configure Azure AD Multi-Factor Authentication fraud alerts" ):
"When users report a fraudulent authentication attempt, you can automatically block their account from future sign-ins until an administrator unblocks them." Therefore, configuring the Block/unblock users settings directly meets the goal.

According to Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn - Manage access reviews in Azure AD Identity Governance, administrators can configure access reviews for users who have access to specific applications. Access reviews are ideal when you need to regularly validate user access and automatically remove inactive or unnecessary accounts, including guest users.
For guest access to applications like App1, Azure AD allows you to configure an access review for application access with recurrence (for example, every 30 days). In the review settings, you can enable the option "Automatically remove access for users who do not respond" or "Remove access if user has not signed in within 30 days." This automation fulfills the requirement to remove access for guest users who haven't used the app in 30 days while minimizing administrative effort-no manual intervention needed.
# Correct Answer: B. an access review for application access

Explanation:

According to the Microsoft SC-300 Study Guide and Microsoft Learn module: "Manage Microsoft 365 group lifecycles" , group expiration policies in Microsoft Entra ID apply only to Microsoft 365 groups (formerly Office 365 groups).
Group expiration is part of lifecycle management for Microsoft 365 services and helps ensure that unused groups are automatically deleted after a defined period unless renewed by the owner.
From the table:
* Group1 (Security) # Cannot be set to expire.
* Group2 (Microsoft 365) # Can be set to expire.
* Group3 (Mail-enabled security) # Cannot be set to expire.
* Group4 (Distribution) # Cannot be set to expire.
Therefore, Group2 only can have an expiration policy applied.
Regarding group lifetime, the Exam Ref SC-300 and Microsoft documentation confirm that the minimum (shortest) group lifetime that can be configured for Microsoft 365 group expiration policies is 30 days.
Microsoft Learn states:
"The group lifetime can be set to 30, 60, 90, 180, or 365 days. The minimum allowed is 30 days." This ensures group owners have sufficient time to renew or manage expiring groups before automatic deletion.