Exam AZ-720 topic 5 question 50 discussion

Actual exam question from Microsoft's AZ-720

Question #: 11
Topic #: 5

DRAG DROP -
A customer has an Azure subscription. Microsoft Defender for servers is enabled for the subscription. The customer has not configured network security groups.
The customer configures a resource group named RG1 that contains the following resources:
• A virtual machine named VM1.
• A network interface named NIC1 that is attached to VM1.
The customer grants a user named Admin1 the following permission for RG1: Microsoft.Security/locations/jitNetworkAccessPolicies/write.
Admin1 reports that the JIT VM access pane in the Azure portal does not show any entries. When you view the same pane, VM1 appears on the Unsupported tab.
You need to ensure that Admin1 can enable just-in-time (JIT) VM access for VM1. The solution must adhere to the principle of least privilege.
Which three actions should you recommend be performed in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Show Suggested Answer

Suggested Answer:

by cris_exam at April 22, 2023, 4:48 p.m.

Comments

Submit Cancel

terawatt

1 year, 11 months ago

1.Grant Admin1 Contributor access to RG1: Admin1 needs the Contributor role in order to create and associate a network security group (NSG). The Microsoft.Security/locations/jitNetworkAccessPolicies/write permission is not enough for these actions. 2.Create NSG in RG1: A network security group needs to be created to control inbound and outbound traffic to resources such as VMs. This is a requirement for JIT VM Access. 3.Associate NSG to the VM NIC: The NSG that was created needs to be associated with the network interface of the VM for which JIT VM access is needed. The JIT VM access feature of Azure Security Center leverages NSGs to lock down inbound traffic to Azure VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed. Thus, without an NSG, JIT VM access won't work. This is why, when viewing the JIT VM access pane, VM1 appears on the Unsupported tab - because there is no NSG associated with it. By following these steps, you should be able to resolve this issue.

upvoted 1 times

...

cris_exam

2 years, 2 months ago

Correct. 1. Grant admin1 Contributor access to RG1. 2. Create NSG in RG1 3. Associate NSG to the VM NIC So, if the JIT shows the VM as unsupported, this means that there is either a need of an NSG or AZFW for JIT to work. In our case here, there is no NSG and the easiest and less privileged way to fix is to create one and associate it to the NIC. https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage#work-with-jit-vm-access-using-microsoft-defender-for-cloud Unsupported - VMs that don't support JIT because: Missing network security group (NSG) or Azure Firewall - JIT requires an NSG to be configured or a Firewall configuration (or both)

upvoted 1 times

...