SC-100 Practice Question: Design solutions that align with security best practices and priorities
You are designing a Zero Trust strategy for Fabrikam Inc., which uses Microsoft Entra ID, Microsoft Intune, and Microsoft Defender for Endpoint. The security team wants to enforce the principle of least privilege for administrative access to Azure resources. They require that administrators use dedicated, cloud-only accounts with no permanent role assignments. You need to recommend a solution that provides just-in-time (JIT) privileged access with approval workflows and full auditing. What should you include in your design?
⚠ Common exam trap
The trap here is assuming that Azure RBAC alone provides just-in-time access, when in fact RBAC assignments are persistent unless combined with PIM for time-bound activation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Privileged Identity Management (PIM)
Microsoft Entra Privileged Identity Management (PIM) is the designated solution for just-in-time privileged access in Microsoft Entra ID and Azure. It enables eligible role assignments, requires approval and MFA for activation, and logs all activations for auditing. This aligns with Zero Trust principles of least privilege and verifies explicitly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Cloud just-in-time (JIT) VM access
Why it's wrong here
Defender for Cloud JIT VM access controls network access to virtual machines by opening management ports on demand. It does not manage privileged role assignments or provide approval workflows for administrative access to Azure resources. It is scoped to VM network security, not identity-based privileged access.
- ✗
Azure role-based access control (RBAC) with custom roles
Why it's wrong here
Azure RBAC with custom roles defines granular permissions but does not include just-in-time activation or approval workflows. Assignments are typically permanent unless manually removed. It lacks the time-bound, approval-based elevation and auditing features required for least-privilege administrative access in this scenario.
- ✓
Microsoft Entra Privileged Identity Management (PIM)
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) provides just-in-time privileged access to Microsoft Entra ID and Azure resources, requiring activation with approval and MFA. It supports eligible assignments, time-bound activations, and comprehensive audit logs, directly fulfilling the requirement for JIT access with approval workflows and auditing.
- ✗
Microsoft Entra ID Conditional Access with device compliance
Why it's wrong here
Conditional Access with device compliance enforces access controls based on device state, user location, and risk. It does not provide just-in-time role activation, approval workflows, or time-bound privileged access. While it is a key Zero Trust component, it does not satisfy the specific requirement for JIT administrative access with approvals.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 605 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.