SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company runs critical applications on Azure virtual machines and on-premises SQL servers. The security team wants to reduce VM attack surface by allowing just-in-time (JIT) access to RDP and SSH ports only when needed. Additionally, they need to monitor changes to important registry keys and system files on the SQL servers. Which Microsoft security solution should they use?
⚠ Common exam trap
Many exam-takers confuse Microsoft Defender for Endpoint's broader device protection capabilities with the specific JIT and FIM features that are exclusive to Microsoft Defender for Cloud.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud provides just-in-time (JIT) VM access to reduce the attack surface by locking down inbound traffic to RDP (port 3389) and SSH (port 22) until a user requests access. It also includes adaptive application controls and file integrity monitoring (FIM) to track changes to registry keys and system files on both Azure VMs and on-premises SQL servers. This makes it the single solution that addresses both requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud provides comprehensive security posture management and threat protection for Azure resources, including virtual machines. It offers Just-in-Time (JIT) VM access, which significantly reduces the attack surface by locking down inbound traffic to VMs and only opening necessary ports for a limited, controlled period. Furthermore, its File Integrity Monitoring (FIM) capability continuously monitors operating system files, application files, and registry keys for suspicious modifications, alerting administrators to unauthorized changes that could indicate a compromise or misconfiguration.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is an enterprise endpoint security platform designed for preventative protection, post-breach detection, automated investigation, and response on devices. While it can protect servers, including Azure VMs, by deploying an agent, its core focus is on Endpoint Detection and Response (EDR) capabilities, not network access control features like Just-in-Time VM access or system-level File Integrity Monitoring (FIM) for the underlying Azure infrastructure.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is a cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It focuses on protecting identity infrastructure from attacks like pass-the-hash, golden ticket, and brute force, using behavioral analytics. However, it does not provide capabilities for securing network access to virtual machines or monitoring file system integrity on the VMs themselves.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and threat protection across cloud applications and services. Its primary role involves discovering shadow IT, enforcing data loss prevention policies, and identifying anomalous usage patterns in SaaS, PaaS, and IaaS environments. This solution is designed for application-level security and governance, not for securing the underlying Azure Virtual Machine infrastructure with features like Just-in-Time VM access or File Integrity Monitoring.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.