nerdexam
Microsoft

AZ-801 · Question #149

You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains the resources shown in the following table. Name Type Description VM1 Virtual machine Runs Windows…

The correct answer is A. Create a network security group (NSG). To implement Just-in-time (JIT) VM access for VM1, the first step is to create a network security group (NSG) if one does not already protect the VM's network interface or subnet.

Secure Windows Server on-premises and hybrid infrastructures

Question

You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains the resources shown in the following table. Name Type Description VM1 Virtual machine Runs Windows Server 2022 NIC1 Network interface Network interface of VM1 PIP1 Public IP address Public IP address assigned to NIC1 Disk1 Disk Managed disk attached to VM1 VNet1 Virtual network Virtual network that contains a subnet named Subnet1 to which NIC1 is attached Sub1 has Microsoft Defender for Servers enabled. You are assigned the Contributor role for Sub1. You need to implement just-in-time (JIT) VM access for VM1. What should you do first?

Options

  • ACreate a network security group (NSG)
  • BEnable enhanced security in Microsoft Defender for Cloud
  • CRequest the Owner role for Sub1
  • DCreate an application security group.

How the community answered

(49 responses)
  • A
    73% (36)
  • B
    6% (3)
  • C
    16% (8)
  • D
    4% (2)

Why each option

To implement Just-in-time (JIT) VM access for VM1, the first step is to create a network security group (NSG) if one does not already protect the VM's network interface or subnet.

ACreate a network security group (NSG)Correct

JIT VM access functions by dynamically modifying Network Security Group (NSG) rules to allow temporary inbound access to specific ports. Therefore, an NSG must be associated with the VM's network interface or subnet to be able to configure and enforce JIT access policies.

BEnable enhanced security in Microsoft Defender for Cloud

The question states that "Sub1 has Microsoft Defender for Servers enabled," which implies enhanced security in Microsoft Defender for Cloud is already active, making this not the first required step.

CRequest the Owner role for Sub1

While the Owner role grants more permissions, the Contributor role is typically sufficient for configuring JIT VM access policies and NSGs; requesting Owner is not the first technical prerequisite.

DCreate an application security group.

An application security group (ASG) groups VMs to simplify NSG rule management for applications but is not a prerequisite for JIT VM access; an NSG is the fundamental requirement.

Concept tested: JIT VM access NSG prerequisite

Source: https://learn.microsoft.com/en-us/azure/security-center/just-in-time-access-usage

Topics

#Just-in-Time (JIT) VM Access#Network Security Group (NSG)#Azure Security#Microsoft Defender for Cloud

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-801 Practice