mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: Uses Microsoft Defender for Cloud and has enabled…
An organization uses Microsoft Defender for Cloud and has enabled enhanced security features. They want to receive alerts when a user attempts to connect to an Azure VM via RDP from a public IP address that is not in a predefined list of trusted IP ranges. Which Defender for Cloud plan or feature provides this capability?
⚠ Common exam trap
Watch out — candidates often confuse Adaptive network hardening (which also adjusts NSG rules) with JIT VM access, but Adaptive network hardening does not enforce a predefined trusted IP list or generate alerts for unauthorized RDP attempts—it only recommends rule changes based on traffic patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Just-In-Time (JIT) VM access
Just-In-Time (JIT) VM access in Microsoft Defender for Cloud allows you to lock down inbound traffic to Azure VMs, reducing exposure to attacks while providing easy access when needed. When enabled, JIT creates rules in the network security group (NSG) that permit RDP (TCP 3389) or SSH (TCP 22) traffic only from specific IP addresses or ranges that you define, and only during a requested time window. If a user attempts an RDP connection from a public IP not in the trusted list, Defender for Cloud generates an alert, as the traffic is blocked by the JIT policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Adaptive network hardening
Why it's wrong here
Adaptive network hardening is wrong because it is a recommendation engine, not a real-time alerting mechanism. It uses machine learning to analyze legitimate traffic patterns and then suggests tightening NSG rules to restrict IP/port pairs, but it does not monitor live connection attempts from unauthorized sources. Therefore, it would not generate an alert when an unapproved IP tries to reach the VM.
- ✗
Network security groups (NSG) flow logs
Why it's wrong here
Network security group (NSG) flow logs are wrong because they are a passive logging feature, not an active alerting control. They capture records of IP traffic flowing through a virtual network, including allowed and denied connections, and send them to an Azure Storage account. However, detecting an unauthorized attempt requires you to run Log Analytics queries or configure a separate SIEM integration to analyze those logs, so no immediate alert is generated.
- ✓
Just-In-Time (JIT) VM access
Why this is correct
Just-In-Time (JIT) VM access is correct because it directly addresses the requirement to alert on unauthorized connection attempts. JIT locks down management ports (such as RDP and SSH) by creating NSG rules that deny all traffic except from approved source IPs and for a limited time window. When an unapproved IP attempts to establish a connection to a protected port, Microsoft Defender for Cloud immediately raises a security alert, satisfying the organization's requirement.
- ✗
File Integrity Monitoring (FIM)
Why it's wrong here
File Integrity Monitoring (FIM) is wrong because it focuses on the state of files and registry keys, not on network access. FIM uses SHA-256 hashing to compare current file and registry values against the last known-good baseline and alerts when a change is detected, such as tampering with system binaries or configuration files. It has no mechanism to inspect inbound connection attempts, IP addresses, or port scanning, so it cannot alert on unauthorized connection attempts.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.