SC-100 Certification Practice Question #102

Question

You have multiple Azure subscriptions that each contains multiple resource groups.

You need to identify the privileged role assignments in each subscription and any associated security risks. The solution must minimize administrative effort.

What should you use?

Accepted Answer

The requirement is to identify (discover/inventory) privileged role assignments across multiple Azure subscriptions and their associated security risks with minimal effort. Microsoft Entra Permissions Management is a CIEM tool whose Analytics dashboard provides exactly this — cross-subscription visibility into all identities' permissions, flagging super-identities, over-provisioned and inactive accounts (the security risks) without per-subscription configuration. Access reviews (A and B) are designed to recertify existing access on a recurring basis, not to inventory and risk-score privileged assignments, and EASM (C) targets external internet-facing assets. The strongest dissent (Ali96, 5 👍 for PIM access reviews) is well-intentioned but conflates recertification with discovery; the Highly Voted top comment explicitly rebuts it. Confidence is held at 85 because of the notable A/B split and the real-world caveat (raised in discussion) that Permissions Management reached end-of-sale/retirement in 2025 — though the exam answer key still expects D.

More SC-100 practice questions