AZ-500 Question 116
Select 2You manage a set of Windows Server 2019 VMs in Azure that handle sensitive data. Your goal is to minimize the attack surface by strictly controlling inbound RDP access and identifying security vulnerabilities on these VMs. You decide to use Microsoft Defender for Cloud to implement just-in-time (JIT) VM access and to enable vulnerability assessment. Which two steps should you perform first to implement advanced security for these compute resources?
- A
Enable just-in-time VM access in Microsoft Defender for Cloud for the required virtual machines.
- B
Install the Azure Monitor agent on each VM to collect performance metrics for advanced analytics.
- C
Deploy the Vulnerability Assessment extension from Microsoft Defender for Cloud on each VM.
- D
Create a custom network security group rule that permanently allows inbound RDP on port 3389 for all IP addresses.
Show answer and explanation
Correct answers: A, C
Explanation
To implement advanced security for Azure compute resources, Microsoft Defender for Cloud provides capabilities such as just-in-time VM access and built-in vulnerability assessment. By enabling JIT provisioning, you limit inbound connectivity windows and approved IP ranges. Deploying the vulnerability assessment extension allows you to proactively discover and address configuration or software vulnerabilities. Refer to Microsoft’s Defender for Cloud documentation for detailed guidance on configuring these features: https://learn.microsoft.com/azure/defender-for-cloud.
- A. Correct.
Correct. Enabling JIT VM access in Microsoft Defender for Cloud restricts RDP access to specified IP addresses and time windows, reducing exposure to potential attacks.
- B. Incorrect.
Incorrect. While the Azure Monitor agent is useful for performance monitoring and diagnostics, it does not directly address JIT access or vulnerability scanning requirements.
- C. Correct.
Correct. Deploying the Vulnerability Assessment extension from Microsoft Defender for Cloud scans for known vulnerabilities, helping you proactively remediate security risks.
- D. Incorrect.
Incorrect. Permanently opening port 3389 to all IP addresses increases the attack surface. The goal is to minimize exposure with just-in-time access control.