AZ-500 Question 115
Select 3You are an Azure Security Engineer for a company that hosts mission-critical Windows and Linux virtual machines (VMs) in Azure. The security team wants to minimize exposure to malicious attacks, ensure compliance through vulnerability assessments, and protect sensitive data on the VMs. You plan to use Microsoft Defender for Cloud to implement advanced security measures. Which three actions should you take to meet these requirements?
- A
Enable Just-in-Time (JIT) VM access for inbound traffic
- B
Open all inbound ports to simplify remote administration
- C
Install the integrated vulnerability assessment extension on each VM
- D
Enable Azure disk encryption using Azure Key Vault
- E
Use hardcoded credentials in VM startup scripts for easier password rotation
- F
Configure ephemeral OS disks on all production VMs
Show answer and explanation
Correct answers: A, C, D
Explanation
To implement advanced security for Azure VMs, use Microsoft Defender for Cloud (formerly Azure Security Center) best practices: enable JIT VM access to reduce inbound threats, deploy built-in vulnerability assessments to identify and fix security gaps, and protect data with disk encryption leveraging Azure Key Vault. For additional guidance, refer to Microsoft documentation on Just-in-Time VM access (https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview) and enabling Azure Disk Encryption (https://learn.microsoft.com/azure/virtual-machines/windows/encrypt-disks).
- A. Correct.
Option 1 is CORRECT. Enabling Just-in-Time VM access significantly reduces your exposure to brute force attacks by restricting inbound network traffic to only the required ports and for a limited time.
- B. Incorrect.
Option 2 is INCORRECT. Opening all inbound ports increases the attack surface and goes against best practices for secure VM configurations. Instead, limit inbound traffic to necessary ports.
- C. Correct.
Option 3 is CORRECT. Microsoft Defender for Cloud’s integrated vulnerability assessment helps identify and remediate security vulnerabilities. Installing the vulnerability assessment extension on each VM is considered a best practice.
- D. Correct.
Option 4 is CORRECT. Enabling Azure disk encryption with Azure Key Vault adds a layer of data protection at rest. This measure helps meet compliance requirements for handling sensitive information.
- E. Incorrect.
Option 5 is INCORRECT. Storing credentials in scripts is insecure and violates best practices. Credentials should be managed using secure methods (e.g., Azure Key Vault).
- F. Incorrect.
Option 6 is INCORRECT. While ephemeral OS disks can improve performance and simplify image-based scaling, they do not address encryption or vulnerability management requirements for advanced security.