SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your company uses Microsoft Defender for Cloud to assess security posture. A recommendation states that virtual machines should have just-in-time (JIT) network access enabled. What is the primary security benefit of enabling JIT?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It reduces the attack surface by opening ports only when necessary
JIT network access reduces the attack surface by keeping network ports closed by default and opening them only when needed for legitimate traffic, based on user requests. It does not block all inbound traffic permanently; it allows authorized requests. It does not encrypt traffic or replace firewall rules; it complements them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It reduces the attack surface by opening ports only when necessary
Why this is correct
Just-in-Time (JIT) VM access significantly reduces the attack surface by ensuring that management ports, such as RDP and SSH, remain closed by default. It dynamically opens these ports only for a limited time and from specified source IP addresses when an authorized request is made. This temporary, conditional access minimizes the window of opportunity for malicious actors to exploit open ports, thereby enhancing the security posture of virtual machines.
- ✗
It replaces the need for network security groups
Why it's wrong here
Just-in-Time (JIT) VM access does not replace the need for Network Security Groups (NSGs); rather, it operates in conjunction with them to enhance security. JIT dynamically modifies the NSG rules to temporarily allow inbound traffic on specific ports for authorized requests. NSGs still provide the foundational layer of network filtering, defining the baseline inbound and outbound rules, while JIT adds a crucial layer of time-bound, conditional access control on top of existing NSG configurations.
- ✗
It encrypts all network traffic between the VM and clients
Why it's wrong here
Just-in-Time (JIT) VM access is a port access control mechanism, not an encryption solution. Its primary function is to restrict and temporarily grant access to specific VM ports, such as RDP or SSH, based on authorized requests. Encryption, conversely, involves encoding data to protect its confidentiality and integrity during transit, which is typically handled by protocols like TLS/SSL or VPNs, and is a separate security control from JIT.
- ✗
It permanently blocks all inbound traffic to the VM
Why it's wrong here
Just-in-Time (JIT) VM access does not permanently block all inbound traffic to the virtual machine. Instead, it maintains a default state where management ports are closed, effectively blocking unsolicited inbound connections. When an authorized user requests access, JIT temporarily modifies the Network Security Group (NSG) rules to open the requested port for a predefined, limited duration, after which the port automatically closes again, restoring the secure default state.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Security posture
An organization's overall cybersecurity strength, including policies, controls, and readiness to defend against and respond to threats.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.