SC-300 Privileged Identity Management (PIM) 2 — Questions and Answers
Question 1: What type of PIM review is used to periodically validate that users still need their privileged role assignments?
- PIM alert review
- Access review (Correct answer)
- Conditional Access audit
- Entitlement management review
Correct answer: Access review
Access reviews in PIM allow administrators to schedule recurring reviews where role members or their managers attest to the continued need for privileged access.
Question 2: A user with an eligible Global Administrator role wants to activate it. They are not prompted for MFA during activation. What is the most likely cause?
- MFA is not configured in the tenant
- The 'Require Azure MFA on activation' setting is disabled for the role (Correct answer)
- The user already has an active session with MFA
- PIM does not support MFA requirements
Correct answer: The 'Require Azure MFA on activation' setting is disabled for the role
If 'Require Azure MFA on activation' is disabled in the PIM role settings for Global Administrator, users will not be challenged for MFA when activating the role.
Question 3: Which PIM feature proactively detects configuration issues such as roles that have too many permanent active assignments and recommends remediation?
- Access reviews
- PIM alerts (Correct answer)
- Identity Secure Score
- Entitlement management
Correct answer: PIM alerts
PIM alerts automatically detect security issues like excessive permanent assignments or stale eligible assignments and provide remediation guidance in the Azure portal.
Question 4: An administrator needs to extend a user's expiring eligible role assignment without having the user re-activate. Which PIM action should the administrator take?
- Create a new eligible assignment with a new end date
- Update the existing assignment's end date using the 'Extend' option (Correct answer)
- Convert the eligible assignment to an active assignment
- Delete and recreate the assignment
Correct answer: Update the existing assignment's end date using the 'Extend' option
PIM provides an 'Extend' option on expiring assignments that allows administrators to push out the expiration date without interrupting the user's eligibility.
Question 5: In PIM for Azure resources, which assignment type makes a user a permanent owner of a resource without any activation required?
- Eligible assignment
- Active assignment (Correct answer)
- Time-bound eligible assignment
- Just-in-time assignment
Correct answer: Active assignment
An active assignment in PIM for Azure resources grants the role permanently and immediately without requiring the user to activate or go through an approval workflow.
Question 6: What minimum Azure AD license is required to use Privileged Identity Management?
- Azure AD Free
- Azure AD Premium P1
- Azure AD Premium P2 (Correct answer)
- Microsoft 365 E3
Correct answer: Azure AD Premium P2
PIM is an Azure AD Premium P2 feature; users who use or benefit from PIM must be licensed with Azure AD Premium P2 or EMS E5.
SC-300 Privileged Identity Management (PIM) 2
What type of PIM review is used to periodically validate that users still need their privileged role assignments?