AZ-500 Manage identity and access Practice Question
A company wants to detect exposed internet-facing assets that are not yet known in its Azure inventory. Which Microsoft Defender capability is most relevant?
⚠ Common exam trap
Watch out — candidates often confuse Defender EASM with Microsoft Entra Permissions Management (CIEM), assuming both deal with 'unknown assets' when in fact CIEM focuses on permissions and identity risks, not external asset discovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Defender External Attack Surface Management
Defender External Attack Surface Management (EASM) is specifically designed to discover and inventory internet-facing assets (e.g., domains, IPs, open ports, certificates) that are not yet known to an organization's Azure inventory. It continuously scans public attack surfaces to identify unknown or unmanaged resources, making it the most relevant capability for detecting exposed assets outside the current Azure footprint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Defender for SQL vulnerability assessment
Why it's wrong here
Defender for SQL vulnerability assessment is a database-specific service that only inspects your existing Azure SQL or SQL Server databases for misconfigurations, missing patches, and known security weaknesses. It requires an already-provisioned SQL resource to scan, and has no capability to discover unknown internet-facing assets. While it helps harden a discrete data service, it cannot map an organization's external attack surface, so it fails the stated requirement.
- ✗
Microsoft Entra Permissions Management
Why it's wrong here
Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) solution that focuses on identities, authorization, and excessive permissions across AWS, Azure, and GCP. It analyzes user and workload access paths to reduce privilege-related risk, but it does not perform network reconnaissance or asset discovery. Discovering unknown internet-facing servers, certificates, or domains is outside its scope, making it an indirect and incorrect choice for this requirement.
- ✓
Defender External Attack Surface Management
Why this is correct
Defender External Attack Surface Management (EASM) continuously discovers and inventories an organization's internet-facing assets, including unknown or shadow IT resources, by scanning domains, IP blocks, ports, and web components from an attacker perspective. It uses Microsoft's global infrastructure data to identify these assets and integrates with Microsoft Defender for Cloud to provide security exposure insights. This is the only option directly engineered to detect exposed assets that were previously not known to the organization.
- ✗
Azure Monitor VM insights
Why it's wrong here
Azure Monitor VM insights is a monitoring capability that tracks the performance, health, and process dependencies of virtual machines that have been explicitly onboarded and have the Log Analytics agent installed. It provides insights like CPU, memory, and network connections for those known VMs, but it cannot discover internet-facing assets that exist outside your Azure subscription or that you don't already manage. Because its visibility ends at the boundary of known and monitored VMs, it does not satisfy the requirement to detect unknown exposed assets.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.