AZ-500 Manage identity and access Practice Question
A company wants to identify excessive permissions across Azure, AWS, and GCP identities. Which Microsoft security capability is designed for cloud infrastructure entitlement management?
⚠ Common exam trap
Many candidates confuse Azure Monitor (a monitoring tool) with a security management tool, or assume a WAF or eDiscovery solution can handle identity permissions, when only a dedicated CIEM like Entra Permissions Management is designed for multi-cloud entitlement visibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Permissions Management
Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides visibility into permissions assigned to identities across multi-cloud environments (Azure, AWS, GCP). It helps detect and remediate excessive, unused, or risky permissions by analyzing identity activity and entitlement data, enabling least-privilege access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Monitor metrics
Why it's wrong here
Azure Monitor metrics is a telemetry pipeline that ingests numeric performance counters (CPU, memory, request latency) into a time-series store for alerting and dashboarding. It has no visibility into directory-level identity assignments, nor does it query cloud providers' IAM authorization systems to compare granted versus used permissions. Consequently, it cannot detect that a principal holds unnecessary administrative roles across Azure, AWS, or GCP, so it fails the stated requirement.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery is built for legal and compliance investigations, not cloud entitlements: it searches custodial content in Exchange, SharePoint, OneDrive, and Teams and can place holds and export evidence. It does not inventory Role-Based Access Control assignments in Azure, IAM policies in AWS, or Cloud IAM roles in GCP, and it never evaluates whether a user's granted access is excessive relative to actual usage. Thus selecting it to identify over-permissioned identities is a category mismatch.
- ✗
Azure Front Door WAF
Why it's wrong here
Azure Front Door WAF operates at the HTTP/S edge, filtering inbound requests against managed and custom rule sets to block injection, XSS, and bot attacks. Its rule evaluation is completely agnostic to who an authenticated caller is and what IAM entitlements that caller holds, and it cannot integrate with outside cloud providers' authorization models. Therefore it cannot perform a cross-cloud entitlement review; a misconfigured but traffic-silent service principal would go entirely undetected.
- ✓
Microsoft Entra Permissions Management
Why this is correct
Microsoft Entra Permissions Management is the correct CIEM (Cloud Infrastructure Entitlement Management) tool because it continuously discovers every identity, role assignment, and permission in Azure, AWS, and GCP, then applies analytics to separate used permissions from unused ones. It calculates a 'permission creep index,' surfaces over-privileged or dormant accounts, and supports remediation actions such as permission right-sizing, on-demand access, and just-in-time elevation. That is exactly the capability needed to identify excessive permissions across all three clouds.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.