AZ-700 Question 77
Single answerYou are a network engineer for a company that has recently enabled Microsoft Defender for Cloud Security Explorer. You suspect several Azure virtual machines may be inadvertently exposed to the internet in violation of corporate security policy. Which action in Microsoft Defender for Cloud Security Explorer most efficiently helps you locate and list all internet-facing resources so you can assess and remediate them?
- A
Enable Just-In-Time (JIT) VM access for all Azure VMs and track JIT configurations to locate internet-exposed machines.
- B
Create a custom Azure Policy to block inbound traffic and evaluate compliance across all subscriptions using Policy Insights.
- C
Use the 'Internet-facing endpoints' filter in Microsoft Defender for Cloud Security Explorer's Network view.
- D
Configure Azure Monitor alerts to detect traffic from unknown IP ranges and list matching VMs in the Security Explorer.
Show answer and explanation
Correct answer: C
Explanation
Microsoft Defender for Cloud Security Explorer provides a centralized view of your network resources with specialized filters, including the 'Internet-facing endpoints' filter. This feature allows you to quickly identify VMs and other network resources exposed to the public internet, which is crucial for remediating any unintended inbound access. Refer to the official Microsoft Defender for Cloud documentation for best practices on using Security Explorer filters to maintain a robust security posture.
- A. Incorrect.
Incorrect. Enabling JIT VM access helps minimize exposure by limiting open ports, but it does not directly provide an inventory of internet-facing resources. It� a useful remediation step but not the primary method to identify exposed VMs in Security Explorer.
- B. Incorrect.
Incorrect. While custom Azure Policies can prevent or track noncompliant configurations, they do not provide an immediate, centralized list of internet-exposed VMs within the Microsoft Defender for Cloud Security Explorer.
- C. Correct.
Correct. Microsoft Defender for Cloud Security Explorer offers a specialized 'Internet-facing endpoints' filter (in the Network view) that shows which resources are receiving inbound traffic from the internet, making this the most direct way to locate at-risk VMs and subnets.
- D. Incorrect.
Incorrect. Although Azure Monitor alerts can notify you of suspicious incoming traffic, it doesn�t automatically generate a list of all internet-exposed hosts within Security Explorer. It is more focused on real-time or threshold-based notifications.