Microsoft Defender for Cloud Capabilities: Cloud Security Posture Management, Just-in-Time VM Access, and Vulnerability Assessment

Quick Answer

The answer is Cloud Security Posture Management (CSPM), Just-in-Time VM Access, and Vulnerability Assessment. These three are core capabilities of Microsoft Defender for Cloud because they directly address different layers of cloud security: CSPM continuously evaluates your environment against compliance frameworks and security benchmarks, while Just-in-Time VM Access reduces the attack surface by locking down inbound traffic to Azure VMs through Network Security Group rules that only open management ports like RDP or SSH when an authorized user requests access for a specific time window and from a specific IP address. Vulnerability Assessment, meanwhile, scans your resources for known weaknesses and integrates with the broader Defender for Cloud dashboard. On the SC-900 exam, this question tests your understanding of Defender for Cloud’s operational features rather than its pricing or deployment models—a common trap is confusing Azure Policy with CSPM, but remember that CSPM is a Defender for Cloud capability, not a separate service. A useful memory tip is to think of the acronym “CJV” (Cloud posture, Just-in-time, Vulnerability) to recall the three distinct pillars of protection.