SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company runs critical Windows virtual machines on Azure. To reduce the attack surface, the security team wants to block all inbound RDP (port 3389) traffic from the internet by default. When a security engineer needs to connect via RDP for troubleshooting, they must request access through a portal, and the RDP port will be opened for a limited time (e.g., 4 hours) only to their source IP address. Which Microsoft security solution should they use to implement this control?
⚠ Common exam trap
A common mix-up: candidates confuse network-level controls (NSGs) with a managed security service that automates temporary access, leading them to choose Option D without realizing NSGs lack the time-limited, request-based workflow that JIT provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud's Just-in-time (JIT) VM access
Microsoft Defender for Cloud's Just-in-time (JIT) VM access is the correct solution because it specifically provides time-limited, request-based opening of inbound ports (such as RDP port 3389) to approved source IP addresses, reducing the attack surface by keeping ports closed by default. This aligns directly with the requirement to block all inbound RDP from the internet by default and allow temporary access only through a portal request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Cloud's Just-in-time (JIT) VM access
Why this is correct
Microsoft Defender for Cloud's Just-in-time (JIT) VM access is a crucial security feature designed to reduce the attack surface of Azure virtual machines. It achieves this by locking down inbound management ports, only opening them for specific, approved source IP addresses for a limited duration. This temporary, on-demand access significantly minimizes exposure to potential threats, aligning with zero-trust principles and enhancing overall VM security posture.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and threat protection for an organization's cloud applications. It focuses on securing SaaS applications like Office 365, Salesforce, and other third-party cloud services by monitoring user activity, detecting anomalous behavior, and enforcing data loss prevention policies. This solution does not, however, directly manage or control inbound network access to Azure IaaS virtual machines.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is an enterprise endpoint security platform that provides preventative protection, post-breach detection, automated investigation, and response capabilities. It operates by monitoring and securing individual devices, such as servers and workstations, against malware, exploits, and other cyber threats through Endpoint Detection and Response (EDR) functionalities. While critical for host-level security, it does not govern network-level inbound traffic rules or provide a just-in-time access mechanism for virtual machines.
- ✗
Azure Network Security Groups (NSGs) with application security groups
Why it's wrong here
Azure Network Security Groups (NSGs) are fundamental for filtering network traffic to and from Azure resources within a virtual network, based on defined rules for IP addresses, ports, and protocols. Application Security Groups (ASGs) further simplify security management by allowing you to group virtual machines and define network policies based on these groups, rather than explicit IP addresses. However, NSGs and ASGs provide static access control and lack the dynamic, time-limited, and approval-driven access workflow that Just-in-time VM access offers.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.