SC-300 Privileged Identity Management (PIM)

Question 1

In Azure AD Privileged Identity Management, what is the difference between an 'eligible' assignment and an 'active' assignment?

Accepted Answer

Eligible users must activate their role before using it; active users have the role immediately without activation

Answer

Eligible assignments require users to go through an activation process (with optional MFA and approval) before the role becomes active, whereas active assignments grant the role immediately.

Question 2

What is the default maximum activation duration for a PIM role assignment?

Accepted Answer

8 hours

Answer

PIM's default maximum activation duration is 8 hours, though administrators can configure this value between 1 and 24 hours per role.

Question 3

Which PIM feature requires a second administrator to approve a role activation request before the role becomes active?

Accepted Answer

Require approval to activate

Answer

The 'Require approval to activate' setting in PIM role settings mandates that a designated approver reviews and approves the activation request before the role is granted.

Question 4

You want to ensure that all eligible Global Administrator role activations are recorded with a business justification. Which PIM role setting should you enable?

Accepted Answer

Require justification on activation

Answer

Enabling 'Require justification on activation' forces users to enter a reason before their role activation is processed.

Question 5

In PIM, which role is required to manage role assignments for Azure AD directory roles?

Accepted Answer

Global Administrator or Privileged Role Administrator

Answer

The Global Administrator and Privileged Role Administrator roles have the authority to configure PIM settings and manage directory role assignments in PIM.

SC-300 - Microsoft Identity and Access Administrator Practice Test

SC-300 - Microsoft Identity and Access Administrator Practice Test

SC-300 Privileged Identity Management (PIM)