Plan and Implement Privileged Access SC-300 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An administrator wants to configure PIM settings for an Azure resource role so that users must provide a business justification when activating the role. Which setting should they enable?

   • AActivation maximum duration
   • BRequire approval to activate
   • CRequire justification on activation
   • DAssignment expiration
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   You are reviewing PIM reports to assess the effectiveness of your identity governance strategy. You notice that a specific user has activated the 'User Administrator' role every day for the past two weeks. The user's job responsibilities do not require daily use of this role. You need to determine whether the user's access is appropriate. What should you do first?

   • ACheck the user's manager to see if they approve of the user's frequent activations.
   • BIncrease the activation duration for the User Administrator role to reduce the need for frequent activations.
   • CReview the user's activation justifications in the PIM audit log to understand why they are activating the role so frequently.
   • DImmediately remove the user's eligible assignment for the User Administrator role.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   Your organization is creating break-glass accounts for emergency access to Microsoft Entra ID. The security team requires that the break-glass accounts are not affected by conditional access policies, including multi-factor authentication, and that they are not assigned to any user for daily use. You need to create the break-glass accounts. What should you do?

   • ACreate two on-premises accounts that are synced to Microsoft Entra ID, and assign the Global Administrator role.
   • BCreate two cloud-only accounts with the Global Administrator role assigned, and exclude them from all conditional access policies.
   • CCreate two accounts with the User Administrator role assigned, and exclude them from conditional access policies.
   • DCreate two accounts with the Global Administrator role assigned, but do not exclude them from conditional access policies.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a recommended practice when creating a break-glass account?

   • AUse the same password as other admin accounts for simplicity
   • BAssign the account to a single named administrator for daily use
   • CUse a long, complex password that is stored securely and not tied to any individual user
   • DExclude the account from all monitoring to avoid alert fatigue
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a key management practice for break-glass accounts to ensure they remain secure?

   • AShare the password with all administrators for convenience
   • BRotate the password only when a security incident occurs
   • CMonitor and alert on any usage of the break-glass accounts
   • DRemove the accounts after a year
   Reveal Solution Discussion Select an answer first