Exam AZ-304 topic 2 question 37 discussion

Indeed. In Conditional Access the App will be represented as a service principal ... not as a managed identity ;) => agreed: A/F

WRONG With Azure AD B2B, the partner uses their own identity management solution, so there is no external administrative overhead for your organization. Guest users sign in to your apps and services with their own work, school, or social identities. *****The partner uses their own identities and credentials, whether or not they have an Azure AD account.****** You don't need to manage external accounts or passwords. You don't need to sync accounts or manage account lifecycles. https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b F is correct. B is definitely wrong by the way.

These statements are wholly incorrect: "if all tenants are azure ad, then there's no need to create guest accounts. If tenants were not Azure AD, then guest account would have been possible. " The definition of a guest user is someone who has an account in another Azure AD tenant. There is no concept of a guest user who ISN'T part of another Azure AD tenant. I have access to about 75 customer Azure tenants at the moment, I live and die on guest user access every day.

No. By a process of elimination we can say only A&F are correct. We must have guest accounts (or B2C etc) for a multi-tenant app, and must have MFA. These facts rule out the other choices.

I can't see anything at all in your ref. that would support alternative C.

B - managed identities ... that's for services and resources mainly and won't make any bridge between your Ad and the other tenants.