easyMultiple ChoiceObjective-mapped
SC-200 Practice Question: Be alerted when a virtual machine is exposed to…
A company wants to be alerted when a virtual machine is exposed to the internet through a permissive network security group rule. Which Microsoft Defender for Cloud feature provides recommendations and alerts for such misconfigurations?
⚠ Common exam trap
Test-takers frequently confuse a feature that actively controls access (like JIT VM access) with one that detects and alerts on existing misconfigurations (adaptive network hardening), leading candidates to choose JIT because it also deals with internet exposure, but it does not generate alerts for permissive NSG rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Adaptive network hardening
Adaptive network hardening (ANH) in Microsoft Defender for Cloud analyzes actual traffic patterns, NSG rules, and internet-facing endpoints to identify overly permissive rules that expose VMs to the internet. It then provides actionable recommendations to tighten those rules and can generate security alerts when such misconfigurations are detected. This directly matches the requirement for alerts on internet exposure via permissive NSG rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Adaptive network hardening
Why this is correct
Adaptive network hardening is a Microsoft Defender for Cloud feature that uses machine learning to analyze historical traffic patterns against current network security group (NSG) rules. When it identifies rules that are overly permissive—such as allowing inbound traffic from the internet on management ports—it generates a security alert and provides a recommendation to restrict the rule. This directly surfaces VMs that are inadvertently exposed to the internet due to flawed NSG configurations.
- ✗
Just-in-time VM access
Why it's wrong here
Just-in-time (JIT) VM access is designed to reduce the attack surface by locking down inbound traffic to specific ports, and only temporarily opening them when an administrator requests access after passing a policy check. It does not perform any ongoing analysis of existing network security group rules, nor does it alert on VMs already exposed via permissive rules. Its purpose is to gate future access, not to detect current exposure.
- ✗
File integrity monitoring
Why it's wrong here
File integrity monitoring (FIM) tracks changes to sensitive files, registry keys, and software installations on virtual machines, primarily to support compliance and forensic investigations. It does not inspect network configuration, IP addresses, or security group rules, so it has no visibility into whether a VM is reachable from the internet. Therefore, it cannot generate an alert about internet exposure.
- ✗
Application controls
Why it's wrong here
Adaptive application controls (part of Microsoft Defender for Cloud) create allowlists of applications that are permitted to run on a VM, using machine learning to build a baseline of trusted binaries and processes. It monitors and alerts on execution of untrusted applications, not on network exposure or inbound connectivity. Consequently, it is entirely unrelated to detecting VMs that are accessible from the internet.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.