Your security team suspects that a user has been activating the Global Administrator role more frequently than necessary. You need to review the user's activation history to determine if there is a pattern of excessive use. What should you do?

Use Microsoft Entra diagnostic settings to export the user's activity logs.

Use Microsoft Entra access reviews to review the user's role assignments.

Use Microsoft Entra sign-in logs to review the user's sign-ins.

Use the PIM audit history to filter activations by the user and review the frequency and duration.

Your organization uses PIM for Azure resources. You need to grant a user temporary access to manage a specific virtual machine, but the user should not be able to delete the VM or its resources. You also need to ensure that the access expires automatically after 4 hours. What should you do?

Assign the user the Contributor role in PIM for the VM with a maximum activation duration of 4 hours.

Assign the user the Virtual Machine Contributor role in PIM for the VM with a maximum activation duration of 4 hours.

Create a custom role with only the required actions and assign it in PIM for the VM with a maximum activation duration of 4 hours.

Assign the user the Reader role in PIM for the VM with a maximum activation duration of 4 hours.

Your organization is creating break-glass accounts for emergency access. You need to ensure that the accounts are not affected by conditional access policies that could block access during an outage. What should you do?

Include the break-glass accounts in all conditional access policies.

Exclude the break-glass accounts from all conditional access policies.

Assign the break-glass accounts the Global Administrator role permanently.

Store the break-glass account passwords in a secure vault.

Your organization uses PIM for groups to manage access to a sensitive application. You need to ensure that users can request membership in the group, but only with approval from their manager. What should you do?

Enable self-service group management in Microsoft Entra ID and set the group owner as the approver.

Assign the user the Group Owner role in PIM and let them approve their own requests.

Create a separate group for each manager and assign the manager as the owner.

Configure the group's PIM settings to require approval for membership requests and set the approver to the user's manager.

Microsoft Certified:Identity and Access Administrator Associate

Domain 4Objective 3

Plan and Implement Privileged Access SC-300 Practice Questions (Page 5)

Part of the Plan and automate identity governance domain, which accounts for 20–25% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 2–4 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

11concepts

20–25%of the exam

Questions 21–25

21foundation · easy
Which PIM report would an administrator use to review all users who currently have an active assignment to a specific Azure AD role?
Select an answer first
22application · medium
Your security team suspects that a user has been activating the Global Administrator role more frequently than necessary. You need to review the user's activation history to determine if there is a pattern of excessive use. What should you do?
Select an answer first
23expert · hard
Your organization uses PIM for Azure resources. You need to grant a user temporary access to manage a specific virtual machine, but the user should not be able to delete the VM or its resources. You also need to ensure that the access expires automatically after 4 hours. What should you do?
Select an answer first
24application · medium
Your organization is creating break-glass accounts for emergency access. You need to ensure that the accounts are not affected by conditional access policies that could block access during an outage. What should you do?
Select an answer first
25application · medium
Your organization uses PIM for groups to manage access to a sensitive application. You need to ensure that users can request membership in the group, but only with approval from their manager. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.