SC-100 Certification Practice Question #108

Question

You have a multicloud environment that contains an Azure subscription and an Amazon Web Services (AWS) subscription.

You need to design a solution that meets the following requirements:

•	Dynamically discovers the permissions granted to and used by each user
•	Generates an aggregated metric that evaluates the level of risk associated with the number of unused or excessive permissions
•	Automatically revokes permissions that have been unused for 90 days
•	Supports granting on-demand permissions for limited periods of time
•	Minimizes administrative effort

Which cloud service should you use for each subscription? To answer, select the options in the answer area.

NOTE: Each correct answer is worth one point.

Accepted Answer

Every requirement maps to Cloud Infrastructure Entitlement Management (CIEM): dynamically discover granted/used permissions, produce an aggregated risk metric (the Permissions Creep Index), auto-revoke permissions unused for 90 days, grant on-demand time-limited permissions, and minimize admin effort across a single multicloud tool. MS Learn states Microsoft Entra Permissions Management "detects, automatically right-sizes, and continuously monitors unused and excessive permissions across your multicloud infrastructure" spanning Azure and AWS, with inactive-identity findings keyed on permissions unused in the last 90 days — a one-product fit for both subscriptions. PIM only covers Entra/Azure-role just-in-time elevation (no AWS discovery or auto-revocation), External ID is external identity, and Defender for Cloud's CIEM, while the documented successor, is not the option presented in the dropdown. The strongest community consensus (four separate commenters, top vote counts) selects Permissions Management for both rows. Confidence is held at 88 (not higher) because the file lists no official Suggested Answer and a 5-👍 comment floats the Defender for Cloud CIEM alternative.

More SC-100 practice questions