SC-300 Exam Dumps : Microsoft Identity and Access Administrator

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and the Microsoft Learn module “Implement Conditional Access Policies,” the Azure AD Conditional Access engine uses a structured framework that consists of conditions, grant controls, and session controls.

1️ ⃣ Configure HighRiskCountries by using A condition In Conditional Access, conditions define the circumstances under which a policy applies. Named locations (such as HighRiskCountries ) are part of the Locations condition. When configuring a Conditional Access policy, administrators can include or exclude sign-ins based on IP address ranges, country/region, or named locations.

Microsoft documentation states: “You can define named locations to specify IP ranges or countries/regions and use them as conditions in your Conditional Access policies.”

Thus, HighRiskCountries should be configured as a condition within the policy to target sign-ins from those regions.

2️ ⃣ Configure Sign-in frequency by using A session control Session controls in Conditional Access determine how sessions behave after a user successfully signs in. The Sign-in frequency setting controls how often users must reauthenticate, effectively limiting the duration of their authentication session.

Microsoft Learn reference: “Session controls, such as sign-in frequency and persistent browser session, enable administrators to enforce how often users must reauthenticate.”

Therefore, to restrict how long a user can remain authenticated when signing in from high-risk countries, you configure Sign-in frequency as a session control.

✅ Final Correct Answers:

HighRiskCountries: A condition

Sign-in frequency: A session control

Azure AD External collaboration settings govern who can bring guests into the tenant. The SC-300 content specifies: “External collaboration settings let you control who can invite guests (Anyone, Members, Guests, or Only admins and users in the Guest Inviter role) and whether guests can invite.” It also highlights: “To restrict guest invitations to administrators or designated inviters, configure External collaboration to ‘Only admins and users in the Guest Inviter role’ and disable guest-to-guest invitations if required.” Because the problem states that “Anyone in the organization can invite guest users, including other guests and non-administrators,” the remediation is to tighten External collaboration settings so only approved roles (e.g., Global admins, Guest Inviter, or specific administrators) can invite. Access reviews address periodic entitlement verification, Conditional Access enforces sign-in/session policies, and Continuous Access Evaluation relates to token lifetime/signal-based revocation; none of these change who can send guest invitations. Adjusting External collaboration settings directly resolves the issue and aligns with the requirement that “only users that are assigned specific admin roles can invite guest users.”