SC-300 Certification Practice Question #229

Question

You have an Azure Active Directory (Azure AD) tenant contains the users shown in the following table.

In Azure AD Privileged Identity Management (PIM), you configure the Global administrator role as shown in the following exhibit.

User1 is eligible for the Global administrator role.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

The exhibit drives rows 1 and 2 directly. "On activation, require Azure MFA = Yes" means an eligible user (User1) must pass MFA to activate the Global administrator role → Row 1 = **Yes**. "Require approval to activate = No" with Approvers = None means there is no approval step at all, so User2 does not approve activation requests → Row 2 = **No**. Row 3 hinges on who may edit a Microsoft Entra role assignment: per MS Learn, only **Privileged Role Administrator** or **Global Administrator** can manage assignments. User3 (Global administrator) qualifies, but User2 is a **Privileged Authentication Administrator** — that role sets/resets authentication methods and can manage sensitive user properties, but it cannot manage PIM role assignments. Because the statement requires *both* User2 **and** User3 to be able to edit the assignment, and User2 cannot, Row 3 = **No**. This gives **YNN**, matching the 39-👍 highly-voted answer and corroborating comments. The small YNY/YNY-style dissent conflates "manage Global Admin accounts" with "manage role assignments," which the docs distinguish.

More SC-300 practice questions