SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Access Azure AD Privileged Identity Management, then select the role to manage, then configure role settings, then add eligible assignments, then manage approvals.

  Why this is correct

  This sequence accurately reflects the logical flow for configuring Azure AD Privileged Identity Management. First, one must navigate to the PIM blade within Azure AD. Next, identifying the specific Azure AD role, such as Global Administrator, is crucial before defining its privilege settings. Subsequently, configuring role settings like activation duration and multi-factor authentication requirements precedes assigning users to be eligible for that role. Finally, managing approval requests is an ongoing operational task once assignments are active.

• ✗

  Add eligible assignments, then configure role settings, then select the role, then access Azure AD PIM, then manage approvals.

  Why it's wrong here

  This order is fundamentally incorrect because administrative actions like adding eligible assignments or configuring role settings cannot precede accessing the Azure AD PIM service itself. One must first enter the PIM portal and then identify the specific role to be managed. Attempting to perform configuration or assignment tasks without first selecting the target role and accessing the PIM interface would be technically impossible within the Azure portal.

• ✗

  Access Azure AD PIM, then configure role settings, then select the role, then add eligible assignments, then manage approvals.

  Why it's wrong here

  This sequence is incorrect because configuring role settings must occur after selecting the specific role to which those settings apply. Role settings, such as activation maximum duration or requiring approval, are inherently tied to a particular Azure AD role (e.g., User Administrator). Attempting to configure generic settings before identifying the target role would result in an invalid or non-applicable configuration within the PIM interface, as the system needs context for the settings.

• ✗

  Access Azure AD PIM, then select the role, then add eligible assignments, then configure role settings, then manage approvals.

  Why it's wrong here

  This order is incorrect because the configuration of role settings, including critical parameters like activation duration, justification requirements, or multi-factor authentication enforcement, should logically precede adding eligible assignments. Establishing these governance controls before assigning users ensures that all new eligible members immediately inherit and comply with the defined security policies upon activation. Assigning users prior to setting these controls could lead to temporary policy gaps or require re-evaluation of assignments.

Go deeper

Related to this question