AZ-500 Question 256
Single answerYou manage an Azure environment with several Windows virtual machines. Microsoft Defender for Cloud has generated a high-severity alert indicating a potential brute force attack against RDP on one of your VMs. You suspect that external attackers are attempting to gain unauthorized access. Which action should you perform first to manage and respond to this alert effectively?
- A
Create a suppression rule for this alert so it no longer appears in the Defender for Cloud dashboard.
- B
Mark the alert as 'dismissed' to reduce the number of active alerts.
- C
Investigate the alert details in Defender for Cloud, review the suspicious IP addresses, and enable Just-In-Time (JIT) VM access for RDP to limit inbound connections.
- D
Immediately disable RDP at the operating system level without further investigation.
Show answer and explanation
Correct answer: C
Explanation
When Defender for Cloud flags a high-severity threat such as a brute force RDP attack, the recommended best practice is to investigate the alert details first, identify suspicious IP addresses, and take appropriate steps to remediate. Enabling JIT VM access allows RDP connections only from specific IP addresses and for limited time windows, thereby reducing the exposure to brute force attacks. For more guidance, refer to the official Microsoft Defender for Cloud documentation: https://learn.microsoft.com/azure/defender-for-cloud
- A. Incorrect.
Incorrect. Suppression rules are typically used for known benign or false-positive alerts. You should first investigate the alert and take remediation steps rather than simply suppressing it.
- B. Incorrect.
Incorrect. Dismissing the alert without investigation risks ignoring a genuine attacker. You should address and remediate the root cause instead of hiding the alert.
- C. Correct.
Correct. Reviewing the alert details is essential to understand the threat. Enabling Just-In-Time VM access for RDP helps reduce the attack surface by restricting inbound connections to the VM, mitigating further brute force attempts.
- D. Incorrect.
Incorrect. Immediately disabling RDP might disrupt legitimate business needs. A more controlled approach, such as JIT access or secure configurations, should be taken after proper investigation.