Administrators should activate eligible privileges only when needed and for a limited time. Which capability directly fits?

1. A data loss prevention policy
2. Privileged Identity Management
3. Password hash synchronization alone
4. Permanent unrestricted role assignment