When managing Azure resource assignments in PIM, what is the purpose of setting an expiration time for an eligible assignment?

To automatically remove the user's eligibility after the specified time

To require the user to re-authenticate after the expiration

To limit the duration of each role activation

To notify the user when the assignment is about to expire

Your organization wants to assess the effectiveness of its PIM implementation. You need to generate a report that shows the number of activations per role over the last 30 days. What should you do?

Use Microsoft Graph API to query role assignments.

Use Microsoft Entra sign-in logs to count role activations.

Use Microsoft Entra access reviews to generate the report.

Use the PIM audit history and export the data to a CSV file, then analyze it in Excel.

Your organization uses PIM to manage Azure resource roles. You need to grant a user temporary access to manage virtual machines in a specific resource group. The user should only be able to start and stop VMs, not delete them. What should you do?

Assign the user the Reader role in PIM for the resource group.

Create a custom role with Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action permissions, then assign it in PIM.

Assign the user the Virtual Machine Contributor role in PIM for the resource group.

Assign the user the Contributor role in PIM for the resource group.

When analyzing PIM audit history, what type of trend might indicate a security concern?

Approvals by designated approvers

A single activation of a role with proper justification

Expiration of eligible assignments

Repeated activations of a privileged role by the same user outside business hours

Your organization uses PIM for the Global Administrator role. You need to reduce the risk of standing access while ensuring that at least one Global Administrator is always available. You have two users who are eligible for the role. What should you do?

Create a break-glass account with a permanent Global Administrator assignment and keep the two users eligible.

Configure PIM settings to allow self-activation without approval and set the maximum activation duration to 4 hours.

Configure PIM settings to require approval for activation and set the maximum activation duration to 8 hours.

Assign one user as permanently active and the other as eligible.

Microsoft Certified:Identity and Access Administrator Associate

Domain 4Objective 3

Plan and Implement Privileged Access SC-300 Practice Questions (Page 4)

Part of the Plan and automate identity governance domain, which accounts for 20–25% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 2–4 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

11concepts

20–25%of the exam

Questions 16–20

16foundation · easy
When managing Azure resource assignments in PIM, what is the purpose of setting an expiration time for an eligible assignment?
Select an answer first
17application · medium
Your organization wants to assess the effectiveness of its PIM implementation. You need to generate a report that shows the number of activations per role over the last 30 days. What should you do?
Select an answer first
18application · medium
Your organization uses PIM to manage Azure resource roles. You need to grant a user temporary access to manage virtual machines in a specific resource group. The user should only be able to start and stop VMs, not delete them. What should you do?
Select an answer first
19foundation · easy
When analyzing PIM audit history, what type of trend might indicate a security concern?
Select an answer first
20expert · hard
Your organization uses PIM for the Global Administrator role. You need to reduce the risk of standing access while ensuring that at least one Global Administrator is always available. You have two users who are eligible for the role. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.