Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel →easyMultiple ChoiceObjective-mapped
AZ-500 Practice Question: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Your security team wants to use Microsoft Defender for Cloud's 'Just-In-Time (JIT) VM access' to reduce the attack surface. Which Azure policy must be enabled on the subscription to use JIT?
⚠ Common exam trap
A common mix-up: candidates confuse the 'Microsoft Defender for Servers' plan with other Defender plans (like Databases or Storage) because they assume any 'Defender' plan can enable JIT, but only the Servers plan provides the necessary VM-level access control and network security group management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Servers
Just-In-Time (JIT) VM access is a feature of Microsoft Defender for Cloud that requires the Microsoft Defender for Servers plan to be enabled on the subscription. This plan provides the advanced threat protection and access control capabilities, including JIT, which dynamically locks down inbound traffic to VMs and opens ports only when authorized users request access via Azure Policy or the portal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Databases
Why it's wrong here
Microsoft Defender for Databases is a specialized plan that protects database engines like Azure SQL and SQL Server on machines; it focuses on threat detection, vulnerability assessments, and access anomalies at the database layer. Just-in-Time VM access, however, is a compute networking control that creates temporary NSG rules for RDP/SSH ports on Azure VMs, which is outside the scope of this plan. As a result, enabling Defender for Databases alone will never expose the JIT blade in Defender for Cloud.
- ✓
Microsoft Defender for Servers
Why this is correct
Microsoft Defender for Servers is the only plan that includes Just-in-Time VM access, which locks down inbound management ports by default and lets defenders request temporary, time-bound access through Defender for Cloud. The feature works by automatically configuring and updating NSG rules to allow a specific source IP and port pair for a defined window, then reverting to close the port. This makes Defender for Servers the correct choice for a security team seeking JIT capabilities for their virtual machines.
- ✗
Microsoft Defender for Storage
Why it's wrong here
Microsoft Defender for Storage is designed to detect anomalies and potential attacks targeting Azure Blob, File, and Data Lake Storage accounts, such as unusual access patterns or malware uploaded. It is entirely a data-plane security service for storage, with no capability to modify network security groups or control SSH/RDP ports on virtual machines. Since Just-in-Time access is a VM-level network enforcement feature, it is not available in this plan.
- ✗
Microsoft Defender for Key Vault
Why it's wrong here
Microsoft Defender for Key Vault continuously monitors the control plane and data plane of Azure Key Vault to flag suspicious access to secrets, keys, and certificates, relying on Microsoft threat intelligence. It never touches compute resources and has no integration with virtual machine endpoint protection or network security groups. Therefore, it lacks the underlying infrastructure to provide Just-in-Time access for VMs, making it an incorrect answer.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.