SC-200 Practice Question: A company enables Microsoft Defender for Cloud on…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable the 'Just-In-Time VM access' plan in Microsoft Defender for Cloud's environment settings

  Why this is correct

  Enabling the Just-In-Time VM access plan in Microsoft Defender for Cloud's environment settings is the prerequisite step that activates the JIT feature for the subscription. Before any VM can be protected or any request processed, the plan must be turned on; after that, you configure individual VMs by selecting ports, allowed source IPs, and the maximum time window for access. Once configured, a user's access request causes Defender for Cloud to dynamically create temporary NSG allow rules, and those rules are automatically removed when the window expires.

• ✗

  Configure a network security group (NSG) to allow RDP traffic from a specific IP range

  Why it's wrong here

  Manually configuring an NSG to allow RDP from a specific IP range produces a static, always-on open port rather than a time-limited, on-demand rule. JIT works by creating its own temporary NSG rules at the moment a user is approved, so a pre-existing static allow rule is neither a prerequisite nor helpful — it would leave an open attack surface whenever no administrator needs access. A manual allow rule also lacks the automated cleanup and audit trail that Defender for Cloud's JIT provides.

• ✗

  Create a security policy assignment to block all inbound RDP traffic

  Why it's wrong here

  Assigning a security policy that blocks all inbound RDP traffic is counterproductive because JIT must insert an allow rule for the requesting IP when access is approved; if a blanket deny rule is present with higher precedence, the allow rule may be overridden, causing even legitimate access to fail. The purpose of JIT is not to ban RDP entirely but to permit RDP only for authenticated, authorized users for a limited window. A blanket block would require manual exceptions and negates the automated, controlled access workflow that JIT delivers.

• ✗

  Install the Log Analytics agent on all VMs

  Why it's wrong here

  Installing the Log Analytics agent provides security event collection, data analytics, and monitoring information, but it does not enforce network access decisions. JIT operates at the Azure Resource Manager control plane by reading and modifying NSG rules, so it does not depend on the agent being present on the VM. The agent may add context about intrusions, but it is irrelevant to JIT's ability to open a port temporarily or to block open-port attack surface.

Go deeper

Related to this question