You are reviewing PIM reports to assess the effectiveness of your identity governance strategy. You notice that the average activation duration for the 'Global Administrator' role has increased over the past three months. The security team is concerned that users are keeping the role active longer than necessary. You need to identify the cause of the increase. What should you do first?

Review the PIM audit log to see if users are extending their activations or if the activation duration setting has been changed.

Check the PIM 'Assignments' report to see if new users have been added to the Global Administrator role.

Remove the eligible assignments for users who have long activation durations.

Increase the activation duration setting for the Global Administrator role to accommodate longer tasks.

Who can be designated as an approver for a role activation in PIM?

Only the user requesting activation

Any user or group specified in the role settings

Any user in the tenant by default

In PIM, what is the typical first step a user takes to request access to a privileged role?

Create a new role assignment in Azure AD

Navigate to My roles and select the role they want to activate

Send an email to the approval group

Contact the Global Administrator to manually assign the role

Your organization has two break-glass accounts for emergency access. The security team wants to ensure that these accounts are not used for routine administrative tasks and that any usage is detected. You need to implement a monitoring strategy for the break-glass accounts. What should you do?

Create a conditional access policy that requires MFA for the break-glass accounts, and create an alert for any sign-in attempt.

Use the Microsoft Entra sign-in logs to monitor sign-ins for the break-glass accounts, and create an alert for any sign-in attempt.

Create a conditional access policy that blocks sign-ins for the break-glass accounts, and create an alert for any sign-in attempt.

Use Microsoft Entra ID Protection to detect risky sign-ins for the break-glass accounts, and create an alert for any sign-in attempt.

What is the primary purpose of a break-glass account in Microsoft Entra?

To serve as a regular admin account for daily tasks

To provide emergency access to critical systems when normal administration is unavailable

To allow external vendors to access the tenant

Microsoft Certified:Identity and Access Administrator Associate

Domain 4Objective 3

Plan and Implement Privileged Access SC-300 Practice Questions (Page 7)

Part of the Plan and automate identity governance domain, which accounts for 20–25% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 2–4 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

11concepts

20–25%of the exam

Questions 31–35

31expert · hard
You are reviewing PIM reports to assess the effectiveness of your identity governance strategy. You notice that the average activation duration for the 'Global Administrator' role has increased over the past three months. The security team is concerned that users are keeping the role active longer than necessary. You need to identify the cause of the increase. What should you do first?
Select an answer first
32foundation · easy
Who can be designated as an approver for a role activation in PIM?
Select an answer first
33foundation · easy
In PIM, what is the typical first step a user takes to request access to a privileged role?
Select an answer first
34application · medium
Your organization has two break-glass accounts for emergency access. The security team wants to ensure that these accounts are not used for routine administrative tasks and that any usage is detected. You need to implement a monitoring strategy for the break-glass accounts. What should you do?
Select an answer first
35foundation · easy
What is the primary purpose of a break-glass account in Microsoft Entra?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.