AZ-900 Describe Azure architecture and services Practice Question
Which Azure feature provides Just-In-Time (JIT) VM access to reduce the attack surface of management ports?
⚠ Common exam trap
Many candidates confuse Azure Bastion (which provides persistent secure access) with JIT VM Access (which dynamically opens and closes ports on demand), as both relate to securing VM management but solve different problems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
JIT VM Access in Microsoft Defender for Cloud
Just-In-Time (JIT) VM access in Microsoft Defender for Cloud reduces the attack surface by locking down inbound traffic to VMs, only opening management ports (e.g., RDP port 3389 or SSH port 22) when requested and for a specific time window. This is the correct feature because it directly implements JIT access to management ports, as described in the question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a fully platform-managed PaaS service that gives users browser-based RDP or SSH connectivity to VMs through the Azure portal, with the connection using TLS over a protected network path. It does not require inbound RDP/SSH ports to be open on the VM nor does it assign public IPs, but it also does not dynamically open and close ports — it acts as a hardened jump host. JIT VM Access, by comparison, reduces the attack surface by using just-in-time NSG rule changes to allow direct, time-limited network access to the management port.
- ✓
JIT VM Access in Microsoft Defender for Cloud
Why this is correct
JIT VM Access in Microsoft Defender for Cloud is a network-security feature that creates time-limited rules in an NSG (and optionally Azure Firewall) to permit inbound traffic to a VM's management port — commonly 3389 for RDP or 22 for SSH — only from the requesting user's IP address. When the approved session ends or the configured duration expires, Defender for Cloud automatically reverts the rules, removing the port exposure. This shrinks the VM attack surface by ensuring management ports are closed at all other times and aligns with the principle of least-privilege network access.
- ✗
Azure AD Privileged Identity Management
Why it's wrong here
Azure AD Privileged Identity Management (PIM) provides just-in-time activation of privileged Azure AD roles or Azure resource roles, requiring approval, MFA, and a time-bound assignment. It is an identity-management control that grants administrative permissions in Azure Active Directory or on Azure resources, but it does not alter network security rules or selectively open ports such as RDP or SSH on a VM. JIT VM Access is a network-layer feature that controls the ability to reach management endpoints, not the privileges of the authenticated user.
- ✗
Azure Key Vault Certificate access
Why it's wrong here
Azure Key Vault is a cloud service for storing and managing cryptographic keys, secrets, and certificates, often used for TLS/SSL offloading or application encryption. Its certificate access policies control who can retrieve or issue certificates, but they have no effect on network traffic, NSG rules, or connection permissions to a VM. Just-in-time (JIT) VM access, in contrast, dynamically edits network security group rules to grant time-boxed inbound access to specific management ports on a VM.
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
Microsoft Defender for Cloud
Microsoft Defender for Cloud is a cloud-native application protection platform that provides unified security management and advanced threat protection across multicloud and hybrid environments.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.