AZ-700 Question 75
Select 2You manage an Azure environment with several virtual machines in a front-end subnet, which is directly accessible from the internet, and a back-end subnet hosting a critical SQL database. Microsoft Defender for Cloud Attack Path Analysis has alerted you that a malicious actor could pivot from a compromised front-end VM to the back-end subnet. The report recommends restricting inbound traffic to only trusted sources and reducing direct exposure of management ports. Which two actions best address these recommendations?
- A
Enable Just-In-Time VM access for the front-end VMs� RDP and SSH ports.
- B
Restrict inbound traffic in the front-end subnet� network security groups to specific IP addresses for sensitive ports.
- C
Set the network security groups to allow all inbound traffic to the front-end subnet to avoid connectivity issues.
- D
Disable all network security group rules in the back-end subnet to simplify traffic control.
Show answer and explanation
Correct answers: A, B
Explanation
Microsoft Defender for Cloud� Attack Path Analysis highlights potential paths that attackers could exploit from publicly accessible resources to sensitive back-end infrastructure. By enabling Just-In-Time VM access (Option 1), admins ensure that remote management ports are only open for a limited time, reducing exposure. Additionally, restricting inbound traffic on the front-end subnet (Option 2) addresses the recommendation to allow only necessary traffic from trusted sources. For further guidance, refer to official Microsoft Defender for Cloud documentation on Attack Path Analysis and Azure NSG best practices in the Microsoft Learn portal.
- A. Correct.
Option 1 is CORRECT because enabling Just-In-Time (JIT) VM access for RDP and SSH helps ensure that these management ports are only open when needed. This reduces the attack surface for front-end VMs and aligns with Defender for Cloud� recommendation to minimize direct exposure of management ports.
- B. Correct.
Option 2 is CORRECT because restricting inbound traffic in the front-end NSGs to trusted IP ranges or specific addresses for critical ports blocks unauthorized access attempts. This aligns with Defender for Cloud� recommendation to minimize the attack path from the internet.
- C. Incorrect.
Option 3 is INCORRECT because allowing all inbound traffic to the front-end subnet defeats the purpose of restricting potential threats from the internet. This approach would not address the Defender for Cloud findings on limiting attack paths.
- D. Incorrect.
Option 4 is INCORRECT because disabling all network security group rules in the back-end subnet would leave the SQL database fully exposed, increasing the attack risk rather than reducing it.