You have an Azure subscription that contains a resource group named RG1 and a security group named ServerAdmins. RG1 contains 10 virtual machines, a virtual network named VNET1, and a network…

Question

Options

• Aan Azure policy assigned to RG1
• Ba just in time (JIT) VM access policy in Azure Security Center
• Can Azure Active Directory (Azure AD) Privileged Identity Management (PIM) role assignment
• Dan Azure Bastion host on VNET1

• A
  4% (1)
• B
  85% (23)
• C
  4% (1)
• D
  7% (2)

Explanation

Explanation

Just-in-Time (JIT) VM Access in Microsoft Defender for Cloud (formerly Azure Security Center) is specifically designed to temporarily open NSG ports (like RDP port 3389) for a defined time window - up to a configurable maximum (such as 60 minutes) - only when an authorized user requests access, then automatically closes the port afterward, which matches the requirement exactly.

Why the distractors are wrong:

• Option A (Azure Policy): Azure Policy enforces compliance rules and governance standards but cannot dynamically control time-limited port access on an NSG.
• Option C (Azure AD PIM): PIM manages temporary elevation of Azure AD roles and permissions, not network-level port access on NSGs.
• Option D (Azure Bastion): Bastion provides a browser-based RDP/SSH gateway that bypasses NSGs entirely, rather than controlling time-limited access through NSG rules.

Memory Tip: Think of JIT as a "timed doorbell" - members must request to be let in, access is granted for a limited time, and the door (NSG port) automatically locks again. If your exam question mentions NSG + time-limited + RDP + on-request, JIT VM Access is almost always the answer.

No community discussion yet for this question.