mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A company uses Microsoft Defender for Cloud's…
A company uses Microsoft Defender for Cloud's Just-In-Time (JIT) VM access to secure its Azure virtual machines. A security analyst needs to grant a developer temporary RDP access to a specific VM for debugging purposes. Instead of using the default request approval flow, the analyst wants to configure an exemption so that the developer's access request never triggers a recommendation for that VM. Which action must the analyst perform?
⚠ Common exam trap
Candidates often confuse 'approving a request with a long expiration' with 'exempting the VM from the recommendation,' not realizing that an exemption is a separate Azure Policy concept that permanently suppresses the recommendation for that resource.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an exemption for the VM on the 'Management ports should be closed on just-in-time based virtual machines' recommendation.
To prevent a specific VM from triggering a recommendation for open management ports, you must add an exemption directly on the 'Management ports should be closed on just-in-time based virtual machines' recommendation in Defender for Cloud. This exemption tells the recommendation engine to exclude that VM from compliance evaluation, so no alert or recommendation is generated for it. Approving a request with a long expiration does not suppress the underlying recommendation; it only grants temporary access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Approve the access request once from the JIT blade and set a long expiration.
Why it's wrong here
Approving a JIT access request from the blade grants a temporary, time-bound opening of the management ports, but it does not change the underlying recommendation state. The recommendation remains active because JIT is not enabled for the VM, and a long expiration is still a short-lived exception rather than a permanent exclusion. This action only satisfies an immediate access need, so the VM will continue to appear as non-compliant and trigger alerts after the window expires.
- ✓
Add an exemption for the VM on the 'Management ports should be closed on just-in-time based virtual machines' recommendation.
Why this is correct
Creating an exemption for the specific VM on the 'Management ports should be closed on just-in-time based virtual machines' recommendation is the correct approach. This exclusion is resource-scoped and suppresses the recommendation for that VM alone, allowing permanent open management ports without generating alerts or affecting compliance state. Exemptions are a standard Defender for Cloud mechanism for legitimate exceptions, and they require the appropriate permissions to create, such as Security Admin or Resource Policy Contributor.
- ✗
Configure a custom Azure Policy to allow open management ports for that VM.
Why it's wrong here
Configuring a custom Azure Policy to allow open management ports would directly contradict the security posture enforced by Just-In-Time VM access, which aims to keep these ports closed. This action would bypass JIT protection entirely for the specified port, leaving it permanently exposed, rather than creating an exemption within JIT's request approval flow. Azure Policy is useful for enforcing organisational standards, such as ensuring specific ports remain closed or defining permanent, policy-driven exceptions for network configurations, but not for managing JIT access recommendations.
- ✗
Disable the JIT solution for the entire subscription from the Defender for Cloud environment settings.
Why it's wrong here
Disabling the JIT solution for the entire subscription is overly broad, as it would disable Just-In-Time access protection for every VM in that subscription, not just the one needing a permanent exception. This action also removes a security control organization-wide rather than creating a targeted exclusion for a single resource. The correct granularity is a per-resource exemption on the recommendation, which preserves JIT for all other workloads.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.