Explanation:
< Statement 1 # No
Statement 2 # No
Statement 3 # Yes
According to the Microsoft SC-300: Microsoft Identity and Access Administrator study guide and Azure AD Privileged Identity Management (PIM) documentation, roles in PIM can be configured for eligible or active assignments.
* User1 is assigned automatically - No The "Add assignments" screen shows User1's assignment type as Eligible, not Active. Eligible assignments mean the user is not automatically granted the role; they must activate it manually when needed. Therefore, User1 is not assigned automatically to the Application Administrator role.
* When User2 requests role assignment, only User3 can approve - No The Role setting details show that approval is required to activate and that the approver is listed as Group1. Because both User2 and User3 are members of Group1, any member of the group can approve the request, not only User3. Hence, the statement that only User3 can approve is incorrect.
* User1's approval on January 31, 2021, at 23:00 - Yes The configuration shows an activation maximum duration of 5 hours. Therefore, if User1's request is approved at 23:00 on January 31, the role remains active for 5 hours - until 04:00 on February 1, 2021. This aligns precisely with the parameters displayed in the exhibit.
As confirmed in Microsoft documentation ( "Configure role settings in Azure AD PIM" ), activation settings define how long a user can remain active after approval, and group approvers allow any member of that group to approve activations.

When enabling an Azure Kubernetes Service (AKS) cluster with a managed identity to access Azure Cosmos DB, you should assign the least privileged role required for the operation directly on the

Explanation:

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment

Explanation:

Explanation:
VM1: Managed1 and Managed2 only
App1: A system-assigned managed identity and Managed2 only
Questions no: 269
Verified Answer :
* VM1: Managed1 and Managed2 only
* App1: A system-assigned managed identity and Managed2 only
Comprehensive and Detailed Explanation with all Microsoft SC-300: Identity and Access Administrator documents :
To answer this question, we must apply the principles of Managed Identities for Azure resources .
Managed identities provide an automatically managed identity in Microsoft Entra ID for applications to use when connecting to resources that support Microsoft Entra authentication (like Azure Key Vault or SQL).
1. Understanding Identity Types:
* User Objects (User1): Standard user accounts are used for human sign-ins. You cannot assign a standard user object (like User1) as the identity of an Azure resource (like a VM or App Service). The resource must use a Service Principal or Managed Identity. Therefore, any option including User1 is incorrect.
* User-Assigned Managed Identities (Managed1, Managed2): These are standalone Azure resources that can be assigned to one or more Azure resources (like VMs or App Services).
* System-Assigned Managed Identities: These are enabled directly on the resource itself and share the resource ' s lifecycle.
2. Analysis for VM1:
* Azure Virtual Machines support User-assigned managed identities .
* You can assign multiple user-assigned identities to a single VM.
* Looking at the dropdown options for VM1:
* Options with User1 are invalid.
* This leaves Managed2 only or Managed1 and Managed2 only.
* Since both Managed1 and Managed2 are valid user-assigned identities available in the subscription, you can assign both.
* Conclusion: Select Managed1 and Managed2 only .
3. Analysis for App1:
* Azure App Services support both System-assigned and User-assigned managed identities concurrently.
* Looking at the dropdown options for App1:
* Options with User1 are invalid.
* Managed1 is not listed in the dropdown options (Managed identities must be in the same region as the resource; often this question implies a region mismatch, or simply restricts the choice).
* Managed2 is listed as a valid user-assigned option.
* A system-assigned managed identity is listed as a valid option.
* Since you can configure an App Service to use both its system-assigned identity and a user- assigned identity simultaneously, the most complete correct answer identifies all capable identities.
* Conclusion: Select A system-assigned managed identity and Managed2 only .
Reference Extract:
" Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure Active Directory... There are two types of managed identities: System-assigned ... and User-assigned
... You can assign a user-assigned managed identity to [Azure Virtual Machines and Azure App Service]. " (Source: Microsoft Learn - What are managed identities for Azure resources?)