SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your company uses Microsoft Defender for Cloud to assess security posture. A recommendation states that virtual machines should have just-in-time (JIT) network access enabled. What is the primary security benefit of enabling JIT?
⚠ Common exam trap
SC-900 often tests the misconception that JIT is an encryption or permanent-blocking feature, when it is actually a time-bound, on-demand port-opening mechanism layered on top of NSGs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It reduces the attack surface by opening ports only when necessary
JIT VM access in Microsoft Defender for Cloud works by keeping management ports (RDP 3389, SSH 22) closed by default and only opening them on demand when an authorized user requests access, for a limited time and from a specific source IP. This dramatically reduces the attack surface exposed to internet-based brute-force and scanning attacks, since the ports are not persistently listening. Once the approved time window expires, Defender for Cloud automatically closes the port via NSG rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It reduces the attack surface by opening ports only when necessary
Why this is correct
Just-in-Time (JIT) VM access significantly reduces the attack surface by ensuring that management ports, such as RDP and SSH, remain closed by default. It dynamically opens these ports only for a limited time and from specified source IP addresses when an authorized request is made. This temporary, conditional access minimizes the window of opportunity for malicious actors to exploit open ports, thereby enhancing the security posture of virtual machines.
- ✗
It replaces the need for network security groups
Why it's wrong here
Just-in-Time (JIT) VM access does not replace the need for Network Security Groups (NSGs); rather, it operates in conjunction with them to enhance security. JIT dynamically modifies the NSG rules to temporarily allow inbound traffic on specific ports for authorized requests. NSGs still provide the foundational layer of network filtering, defining the baseline inbound and outbound rules, while JIT adds a crucial layer of time-bound, conditional access control on top of existing NSG configurations.
- ✗
It encrypts all network traffic between the VM and clients
Why it's wrong here
Just-in-Time (JIT) VM access is a port access control mechanism, not an encryption solution. Its primary function is to restrict and temporarily grant access to specific VM ports, such as RDP or SSH, based on authorized requests. Encryption, conversely, involves encoding data to protect its confidentiality and integrity during transit, which is typically handled by protocols like TLS/SSL or VPNs, and is a separate security control from JIT.
- ✗
It permanently blocks all inbound traffic to the VM
Why it's wrong here
Just-in-Time (JIT) VM access does not permanently block all inbound traffic to the virtual machine. Instead, it maintains a default state where management ports are closed, effectively blocking unsolicited inbound connections. When an authorized user requests access, JIT temporarily modifies the Network Security Group (NSG) rules to open the requested port for a predefined, limited duration, after which the port automatically closes again, restoring the secure default state.
Go deeper
Related to this question
Learn chapter
Azure NSG and Application Security Groups
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
Key term
Security posture
An organization's overall cybersecurity strength, including policies, controls, and readiness to defend against and respond to threats.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.