AZ-500 Question 119
Select 2Your company runs several Windows and Linux VMs in Azure for internal line-of-business applications. They want to remove direct RDP and SSH access from the Internet, but still allow administrators to request time-bound access for auditing purposes. You plan to deploy Azure Bastion and configure Just-In-Time (JIT) VM access. Which two steps should you perform to meet these requirements?
- A
- Deploy the Azure Bastion host to the same virtual network as the VMs, and remove any public IP addresses from the VMs
- B
- Configure Just-In-Time VM access in Microsoft Defender for Cloud to limit inbound RDP/SSH to approved requests
- C
- Keep default inbound NSG rules open for 3389 and 22 to allow remote connections at any time
- D
- Add your internal and external IP ranges to the VM’s NSG rules for permanent remote access
- E
- Deny inbound and outbound traffic on the AzureBastionSubnet to restrict unexpected traffic
Show answer and explanation
Correct answers: A, B
Explanation
Azure Bastion provides a secure, browser-based method to connect to Azure VMs without exposing RDP or SSH ports directly to the Internet. Removing the public IP addresses and placing the VMs behind Azure Bastion minimizes the attack surface. Just-In-Time (JIT) access, configured in Microsoft Defender for Cloud, ensures these ports are only opened on a time-bound and approval-based workflow. Combining both services helps maintain a strong security posture in Azure. Refer to Microsoft Documentation on 'Use Azure Bastion to connect to a VM' and 'Just-in-time VM access in Microsoft Defender for Cloud' for detailed implementation guidance.
- A. Correct.
Option 1: Correct. Deploying Azure Bastion in the same virtual network as the VMs and removing their public IP addresses prevents direct RDP/SSH traffic from the Internet. Administrators then use the Azure Bastion service over a secure, browser-based connection.
- B. Correct.
Option 2: Correct. Configuring JIT VM access ensures that RDP/SSH ports will only be open during approved request windows, enhancing security and auditability for administrative access.
- C. Incorrect.
Option 3: Incorrect. Leaving ports permanently open defeats the purpose of JIT access and exposes the VMs to unnecessary risk. JIT is intended to close these ports except when access is explicitly approved.
- D. Incorrect.
Option 4: Incorrect. Manually adding IP ranges for continuous inbound connections is contrary to the goal of removing direct Internet access and relying on Azure Bastion and JIT.
- E. Incorrect.
Option 5: Incorrect. Denying all traffic on the AzureBastionSubnet would break the Bastion host functionality and prevent legitimate connections from Bastion to the VMs.