You have an Azure subscription named Sub1 that contains the virtual machines shown in the following table. You need to ensure that the virtual machines in RG1 have the Remote Desktop port closed…

Question

Exhibits

Options

• AAzure Active Directory (Azure AD) Privileged Identity Management (PIM)
• Ban application security group
• CAzure Active Directory (Azure AD) conditional access
• Djust in time (JIT) VM access

• A
  16% (3)
• B
  11% (2)
• C
  5% (1)
• D
  68% (13)

Explanation

JIT VM Access Explanation

Why D is correct: Just-in-Time (JIT) VM access, available through Microsoft Defender for Cloud, is specifically designed to lock down inbound traffic to Azure VMs by closing management ports (like RDP port 3389) by default, and only opening them temporarily when an authorized user explicitly requests access for a defined time window - exactly matching the scenario described.

Why the distractors are wrong:

• A (PIM) manages privileged roles and permissions within Azure AD/resources, not network port access on VMs
• B (Application Security Groups) are used to group VMs for network security rule application, but don't provide the dynamic open/close port request mechanism described
• C (Conditional Access) controls authentication and authorization conditions for accessing Azure AD applications and resources, not VM-level port management

Memory Tip

Think of JIT as a security guard at a door - the RDP port (door) stays locked by default, and only opens for a specific person, for a specific time, when they knock and identify themselves. The phrase "Just In Time = Just When Needed" helps reinforce that access is temporary and on-demand, which is the core concept being tested here.

No community discussion yet for this question.