Exam AZ-500 topic 6 question 29 discussion

Actual exam question from Microsoft's AZ-500

Question #: 29
Topic #: 6

HOTSPOT
-

You have an Azure subscription that contains a virtual machine named VM1.

You have a network security group (NSG) named NSG1 that is associated to the network interface of VM1 and is configured as shown in the following exhibit.

Just-in-time (JIT) VM access is enabled on VM1 and has the following configurations:

• Management ports: 3389, 22
• Maximum time range: 3 hours
• Allowed source IP addresses: Any

You activate the JIT rule and connect to VM1 by using SSH.

For each of the following statements, select Yes if the statement is true, otherwise select No.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by BeginLearningforPP at Sept. 7, 2024, 12:57 a.m.

Comments

Submit Cancel

BeginLearningforPP

Highly Voted 9 months, 1 week ago

Answers are No No Yes

upvoted 6 times

Viggy1212

8 months, 2 weeks ago

For #1, If other rules already exist for the selected ports, then those existing rules take priority over the new "deny all inbound traffic" rules. If there are no existing rules on the selected ports, then the new rules take top priority in the NSG and Azure Firewall. Source https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks Answer : Yes

upvoted 4 times

cerifyme85

7 months, 3 weeks ago

Takes priority over "deny" not "allow"-- NO

upvoted 2 times

...

ca7859c

Most Recent 1 week ago

N N N For #1 JIT takes precedence over NSG & Firewall https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks#just-in-time-access-and-network-resources For #2 For every new connection, you will need to request access https://tech.zsoldier.com/2021/01/powershell-azure-submitting-jit-request.html#:~:text=Connection%20will%20stay%20active%20as%20long%20as%20I%20maintain%20it%2C%20otherwise%20I%20get%20disconnected%20and%20have%20to%20go%20through%20JIT%20process%20again. For #3 Any connection established during the 3 hour window that persists after the window expires will stay active. Any new connections will be denied.

upvoted 1 times

...

randy0077

2 months, 2 weeks ago

Answer YNN: https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks#:~:text=Connections%20that%20are%20already%20established%20aren%27t%20interrupted.

upvoted 1 times

...

Hot_156

3 months, 2 weeks ago

N - JIT are usually created with priority 100. However, if the RDP have priority 100 then JIT would not replace this. N - Session is open until the time is gone N - "Connections that are already established aren't interrupted." Check the link "https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks"

upvoted 3 times

...