SC-300 Certification Practice Question #110

Question

You have a Microsoft 365 tenant.

You configure a conditional access policy as shown in the Conditional Access policy exhibit. (Click the Conditional Access policy tab.)

You view the User administrator role settings as shown in the Role setting details exhibit. (Click the Role setting details tab.)

You view the User administrator role assignments as shown in the Role assignments exhibit. (Click the Role assignments tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

Rows 1 and 2 are uncontested and confirmed by both the settings exhibit and MS Learn: the role requires approval to activate (so Admin1 needs approver sign-off before using the role → Yes), and a user activating an eligible role chooses any duration up to the 8-hour maximum, so a 2-hour activation is permitted → Yes. Row 3 is the crux. Although the Conditional Access policy enforces MFA at sign-in and the PIM role has "On activation, require Azure MFA = Yes," MS Learn explicitly states a user "might not be prompted for multifactor authentication if they... provided multifactor authentication earlier in this session" — the MFA claim is carried in the Primary Refresh Token, so PIM honors the existing claim and does not re-prompt. Multiple commenters who tested this in their own tenants (Holii, SFAY, 217f3c9) confirm the user is not challenged twice, giving YYN. The YYY dissent (chikorita) is logically reasonable from the policy text alone but is contradicted by the documented session-MFA reuse and by the tested results, so confidence is set in the strong-agreement-with-minor-dissent band rather than higher.

More SC-300 practice questions