You have a Microsoft 365 tenant.

The SC-300 Study Guide section on “Implement Access Reviews” states that administrators can create access reviews for groups, roles, or applications. When the scenario involves verifying external users’ access to specific applications — such as the Exchange admin center — the proper configuration is an application-based access review targeting guest users.

Microsoft Learn specifies:

“Application access reviews allow you to periodically verify external users’ access to enterprise applications integrated with Azure AD.”

Since the contractor is an external (guest) user and the access is to a specific application (Exchange admin center), you must configure an application-based review, not a group-based or directory-based one.

✅ Correct Answer: D. an application-based access review that targets guest users