AZ-700 Question 76
Select 2Your organization hosts several Azure virtual machines (VMs) within a shared production subnet. Microsoft Defender for Cloud Attack Path Analysis has identified security risks for a specific Windows VM that is directly exposed to the internet over TCP port 3389 (RDP) without multi-factor authentication. Additionally, the production subnet lacks a properly configured Network Security Group (NSG) restricting inbound traffic. You have been asked to implement the recommended mitigations from Defender for Cloud. Which two actions should you take to address the network security recommendations?
- A
A. Enable Just-In-Time (JIT) VM access for TCP port 3389 and restrict source IP ranges in the associated NSG.
- B
B. Deploy an Azure Firewall and allow inbound traffic from any source to TCP port 3389.
- C
C. Remove the VM� public IP and require RDP sessions to be established using Azure Bastion or a jump box.
- D
D. Grant full inbound access to the VM on port 3389 in the NSG, provided you enable multi-factor authentication for the local Administrator account.
Show answer and explanation
Correct answers: A, C
Explanation
Defender for Cloud Attack Path Analysis often highlights unsecured management ports as critical vulnerabilities. Just-In-Time (JIT) access narrows the attack window and source IP range, while removing direct public IP addresses prevents simple port scanning and automated attacks. Azure Bastion is a recommended option to securely manage VMs without exposing RDP on the internet. For more details, refer to Microsoft� documentation on Microsoft Defender for Cloud attack path analysis (https://learn.microsoft.com/azure/defender-for-cloud/secure-score-attack-path-analysis) and Just-In-Time VM access (https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access).
- A. Correct.
Option A: Correct. Enabling JIT access for RDP and configuring strict NSG rules aligns with Defender for Cloud� recommendation to reduce the attack surface on port 3389. JIT limits the time window and allowed source IPs for RDP, thus mitigating incorrect open inbound rules.
- B. Incorrect.
Option B: Incorrect. Merely deploying an Azure Firewall but allowing inbound traffic from any source does not address the open-exposure issue. Defender for Cloud recommendations emphasize limiting inbound connections to trusted IPs or using secure entry points.
- C. Correct.
Option C: Correct. Removing the public IP from the VM and funneling access through a secure service like Azure Bastion or a dedicated jump box prevents direct internet exposure. This directly aligns with Defender for Cloud� recommendation to minimize exposed endpoints on critical ports.
- D. Incorrect.
Option D: Incorrect. Granting inbound access to everyone on port 3389, even with MFA on the local Administrator account, weakens the network security posture. While enforcing multi-factor authentication is helpful at the OS level, the network should be restricted at the perimeter per Defender for Cloud guidance.