SC-300 Certification Practice Question #232

Question

You have an Azure Active Directory (Azure AD) tenant that contains three users named User1, User2, and User3.
You create a group named Group1. You add User2 and User3 to Group1.
You configure a role in Azure AD Privileged Identity Management (PIM) as shown in the Application Administrator exhibit. (Click the Application Administrator tab.)

Group1 is configured as the approver for the Application administrator role.
You configure User2 to be eligible for the Application administrator role.
For User1 you add an assignment to the Application administrator role as shown in the Assignment exhibit. (Click the Assignment tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

Rows 1 and 2 are settled. Row 1 is No because User1 holds an *eligible* (not active) assignment for an approval-required role (img1/img2), so access isn't granted automatically. Row 2 is Yes because Group1 is the approver and PIM forbids approving your own activation request, leaving User3 as the only valid approver for User2. Row 3 is the genuine split: the assignment exhibit ends User1's eligibility at 01/31/2021 11:59 PM, and PIM's expiration rule treats the assignment end as a hard limit — you cannot activate (or remain active) beyond it, so the role cannot be used until Feb 1 04:00 even though the activation-maximum is 5 hours. cgonIT's lab test (ExpirationRule failure) and the N,Y,N voters (Nyamnyam 16, b233f0a 6, LeTrinh 4) ground this in the documented behaviour. The competing N,Y,Y (existingname 23, Hot_156 7) assumes the 5-hour activation window survives the assignment expiry, which MS Learn's expiration rule does not support. Confidence is lowered to reflect the active community disagreement on Row 3.

More SC-300 practice questions