SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Microsoft Entra Privileged Identity Management (PIM)

  Why it's wrong here

  Microsoft Entra Privileged Identity Management (PIM) enables organizations to manage, control, and monitor access to important resources within Azure AD and Azure. It provides just-in-time access and approval workflows for *roles*, such as Azure AD administrative roles or Azure resource roles (e.g., Virtual Machine Contributor). While it offers JIT principles, it does not directly manage or control access to specific network ports (like RDP or SSH) on individual virtual machines themselves, which is the core requirement here.

  When this WOULD be correct

  A question asks: 'Which Microsoft solution provides just-in-time and time-bound privileged role assignments for Azure AD roles, such as Global Administrator, with approval workflows?' In that context, Microsoft Entra PIM is the correct answer.

• ✗

  Microsoft Defender for Identity

  Why it's wrong here

  Microsoft Defender for Identity is a cloud-based security solution focused on detecting advanced threats, compromised identities, and malicious insider actions targeting on-premises Active Directory environments. It monitors user behavior and detects anomalies related to identity-based attacks, such as pass-the-hash or golden ticket. However, it does not provide functionality for managing or granting just-in-time access to administrative ports (like RDP or SSH) on virtual machines, making it unsuitable for this specific security control.

  When this WOULD be correct

  A question asking which Microsoft solution detects and investigates advanced attacks against on-premises Active Directory environments, such as pass-the-hash or golden ticket attacks, would have Microsoft Defender for Identity as the correct answer.

• ✓

  Microsoft Defender for Cloud (with just-in-time VM access)

  Why this is correct

  Microsoft Defender for Cloud provides advanced threat protection and security posture management for hybrid cloud workloads, including Windows Server virtual machines. Its Just-in-Time (JIT) VM access feature specifically addresses the requirement by allowing temporary, controlled access to management ports like RDP. This significantly reduces the attack surface by keeping these ports closed by default, only opening them for a limited time upon approval, which is crucial for securing critical applications.

• ✗

  Microsoft Defender for Cloud Apps

  Why it's wrong here

  Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), offering comprehensive visibility, control, and threat protection across cloud applications and services. It helps identify shadow IT, enforce data loss prevention policies, and detect anomalous behavior within SaaS applications. However, its scope is entirely focused on cloud application security and data governance, and it does not provide any mechanism for managing just-in-time access to administrative ports on virtual machines.

  When this WOULD be correct

  A question asks: 'Which Microsoft solution provides visibility and control over shadow IT, enforces data loss prevention policies, and detects anomalous behavior in cloud applications like Microsoft 365 and Salesforce?' In that scenario, Microsoft Defender for Cloud Apps would be the correct answer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question