SC-100 Practice Question: Design solutions that align with security best practices and priorities
A company wants to enforce that all administrators use just-in-time (JIT) access to privileged roles in Microsoft Entra ID. Which feature should they enable?
⚠ Common exam trap
Many candidates confuse Conditional Access (which controls access to apps) with PIM (which controls privileged role activation), leading them to select Option A because they think JIT access is a policy-based access control feature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Privileged Identity Management (PIM)
Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by enabling time-bound and approval-based role activation. This directly meets the requirement to enforce JIT access for administrators, as PIM allows roles to be activated only when needed and for a limited duration, reducing standing access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Conditional Access
Why it's wrong here
Conditional Access is an identity-driven policy engine that evaluates sign-in risk, device compliance, and MFA challenges before granting access to applications or services. It can enforce authentication context or require conditions during PIM role activation, but it has no concept of role eligibility or time-bound activation. As a result, it cannot by itself provide just-in-time privilege elevation; that activation workflow is owned by PIM.
- ✓
Microsoft Entra ID Privileged Identity Management (PIM)
Why this is correct
PIM is the Entra ID service purpose-built for just-in-time, time-bound privileged role activation. Administrators are made eligible for roles, and when they need access they activate for a requested duration—optionally with MFA, business justification, and an approval workflow—after which the role expires automatically. This directly replaces permanent 'standing' admin access with auditable, as-needed elevation.
- ✗
Microsoft Entra ID Access Reviews
Why it's wrong here
Access Reviews are a governance and recertification control that periodically asks owners or designated reviewers to confirm whether users still need membership in privileged roles or groups, and can automatically remove stale or unapproved assignments. They address long-lived access lifecycle, not the moment-of-need elevation; a review might run monthly or quarterly, while JIT activation must be available in minutes and expire after hours. Therefore Access Reviews support PIM but are not the enforcement mechanism for just-in-time access.
- ✗
Microsoft Entra ID Protection
Why it's wrong here
Identity Protection continuously analyzes user and sign-in risk—leaked credentials, anonymous IPs, impossible travel—and can trigger risk-based remediation such as requiring password change or blocking sign-in. It is designed to detect compromised identities, not to manage duration-bound activation of privileged roles. Thus it has no workflow to enable an administrator's role for a short window; that functional gap is exactly what PIM fills.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 605-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.