SC-100 Certification Practice Question #169

Question

You have an Azure subscription. The subscription contains an Azure Bastion host and 100 virtual machines that run Windows Server 2022. The virtual machines have Microsoft Defender for Servers Plan 2 enabled.

You need to recommend a security solution for the virtual machines that meets the following requirements:

•	Administrators must request RDP access to the virtual machines by using the Azure portal.
•	Remote Desktop sessions must be limited to a maximum of three hours.
•	Agentless scanning must be scheduled to run on each virtual machine.

What should you recommend using? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The first requirement — administrators request RDP via the Azure portal with sessions capped at three hours — is the textbook description of Defender for Servers just-in-time (JIT) VM access; MS Learn explicitly shows requesting access from the Azure portal and configuring a maximum 3-hour window. The second requirement is scheduled agentless scanning: in Defender for Servers Plan 2, agentless vulnerability scanning is delivered by Microsoft Defender Vulnerability Management, whereas the Qualys and Rapid7 options are BYOL scanners that install an agent/extension and therefore fail the "agentless" requirement. The highest-voted comment correctly chose JIT but mislabeled Qualys as agentless; MS Learn overrides that error, which is why confidence sits in the high-80s rather than the 90s.

More SC-100 practice questions