SC-900 Describe the capabilities of Microsoft Entra Practice Question
Exhibit
Refer to the exhibit.
```json
{
"roleSettings": [
{
"roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
"approvalRequired": true,
"activationMaximumDuration": "PT1H",
"eligibleAssignment": {
"assignmentType": "eligible",
"endDateTime": null
}
}
]
}
```Refer to the exhibit. You are reviewing a Privileged Identity Management (PIM) configuration for a role in Microsoft Entra ID. The roleDefinitionId corresponds to a specific role. What is the effect of this configuration?
⚠ Common exam trap
Many exam-takers confuse 'Eligible' with 'Active' assignments, assuming that an eligible assignment with no approval required means the user is automatically active, when in fact they must still manually activate the role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user is eligible for the role indefinitely, but activation requires approval and lasts up to 1 hour.
The configuration shown in the exhibit sets the role assignment to 'Eligible' with an activation duration of 1 hour and requires approval (the approval toggle is on). An 'Eligible' assignment means the user is not permanently active; they must activate the role when needed. The requirement for approval ensures that an authorized approver must approve each activation request. The 1-hour duration limits how long each activation lasts. This matches the description of being eligible indefinitely, with activation requiring approval and lasting up to 1 hour.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user is permanently activated for the role for 1 hour.
Why it's wrong here
Assignment is eligible, not active. Activation is temporary.
- ✗
The user is permanently assigned the role for 1 hour.
Why it's wrong here
Assignment is eligible, not active. Activation is time-bound.
- ✗
The user can activate the role without approval for up to 1 hour.
Why it's wrong here
Approval is required (approvalRequired: true).
- ✓
The user is eligible for the role indefinitely, but activation requires approval and lasts up to 1 hour.
Why this is correct
Eligible assignment with no end date, approval required, activation max 1 hour.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
PIM
Privileged Identity Management, a Microsoft Azure Active Directory tool that manages, monitors, and controls access to privileged roles on a just-in-time basis.
Key term
Privileged Identity Management
Privileged Identity Management is a security system that controls, monitors, and audits access to sensitive systems by granting elevated permissions only when needed and for a limited time.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.