AZ-500 Question 120
Select 2You are a cloud security engineer for Contoso, which hosts Windows and Linux VMs on Azure for internal HR applications. The environment is protected by a network security group that denies all inbound traffic by default. The IT team requires a secure solution that allows administrators to RDP or SSH into these VMs for maintenance without exposing ports to the public internet. Which two approaches should you recommend to minimize inbound exposure while still providing authorized remote access? (Choose two.)
- A
Deploy Azure Bastion in the same virtual network, enabling browser-based RDP/SSH access without public ports.
- B
Configure a jump box with a public IP in the same virtual network and open port 3389 to all inbound traffic for easy access.
- C
Enable just-in-time VM access from Microsoft Defender for Cloud to restrict RDP/SSH ports to approved time windows and IP ranges.
- D
Create a user-defined route to forward all external traffic through your on-premises network, then open RDP/SSH ports in your network security group for persistent access.
Show answer and explanation
Correct answers: A, C
Explanation
Azure Bastion eliminates the need for a public IP address on VMs by providing browser-based RDP/SSH, while JIT access in Microsoft Defender for Cloud only opens network ports when needed and to authorized IP ranges. Together, these solutions align with best practices for minimizing remote access attack surfaces while meeting administrative requirements. For more details, refer to the official Microsoft documentation on Azure Bastion (https://learn.microsoft.com/azure/bastion/bastion-overview) and Just-in-Time VM access with Microsoft Defender for Cloud (https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview).
- A. Correct.
Option 1 is correct. Deploying Azure Bastion allows you to connect via a web client without exposing RDP or SSH ports directly to the internet. Bastion is deployed in the same VNet, providing a secure, simplified remote connection.
- B. Incorrect.
Option 2 is incorrect. While a jump box is a common pattern, configuring it with a public IP and opening port 3389 to all traffic undermines security by exposing the port to the entire internet, which doesn’t minimize inbound exposure.
- C. Correct.
Option 3 is correct. Just-in-time (JIT) access in Microsoft Defender for Cloud helps reduce attack vectors by only opening necessary ports for a short time and limiting access to specific external IPs. This aligns with minimizing exposure while granting legitimate access.
- D. Incorrect.
Option 4 is incorrect. By directing all traffic to on-premises and then opening RDP/SSH ports in the network security group, ports still remain persistently open. This approach is less secure and does not address the central requirement to limit inbound exposure.