SC-200 · Question #133
You have an Azure subscription that uses Microsoft Defender for Cloud and contains a resource group named RG1. RG1 contains 20 virtual machines that run Windows Server 2019. You need to configure…
The correct answer is D. Azure Bastion. Azure Bastion provides browser-based RDP and SSH access to VMs through the Azure portal without ever exposing management ports (like RDP 3389) to the public internet. It meets all three requirements: it naturally restricts connections to RDP and SSH only - satisfying the 'RDP…
Question
You have an Azure subscription that uses Microsoft Defender for Cloud and contains a resource group named RG1. RG1 contains 20 virtual machines that run Windows Server 2019. You need to configure just-in-time (JIT) access for the virtual machines in RG1. The solution must meet the following requirements:
- Limit the maximum request time to two hours.
- Limit protocols access to Remote Desktop Protocol (RDP) only.
- Minimize administrative effort.
What should you use?
Options
- AAzure AD Privileged Identity Management (PIM)
- BAzure Policy
- CAzure Front Door
- DAzure Bastion
How the community answered
(48 responses)- A10% (5)
- B6% (3)
- C2% (1)
- D81% (39)
Explanation
Azure Bastion provides browser-based RDP and SSH access to VMs through the Azure portal without ever exposing management ports (like RDP 3389) to the public internet. It meets all three requirements: it naturally restricts connections to RDP and SSH only - satisfying the 'RDP only' protocol requirement; it supports session-based time-limited access satisfying the 2-hour maximum request window; and a single Bastion host deployed in the virtual network serves all VMs in that VNet, avoiding per-VM JIT policy configuration and minimizing administrative effort for 20 VMs. Azure AD PIM (A) manages privileged Azure AD role assignments, not VM network-level access. Azure Policy (B) enforces governance standards but does not provide an access gateway. Azure Front Door (C) is a global web application delivery and CDN service, irrelevant to VM management access.
Community Discussion
No community discussion yet for this question.