exam questions

Exam AZ-500 All Questions

View all questions & answers for the AZ-500 exam

Exam AZ-500 topic 3 question 3 discussion

Actual exam question from Microsoft's AZ-500
Question #: 3
Topic #: 3
[All AZ-500 Questions]

SIMULATION -
You need to configure Azure to allow RDP connections from the Internet to a virtual machine named VM1. The solution must minimize the attack surface of VM1.
To complete this task, sign in to the Azure portal.

Show Suggested Answer Hide Answer
Suggested Answer: See the explanation below.
To enable the RDP port in an NSG, follow these steps:
1. Sign in to the Azure portal.
2. In Virtual Machines, select VM1
3. In Settings, select Networking.
4. In Inbound port rules, check whether the port for RDP is set correctly. The following is an example of the configuration:

Priority: 300 -

Name: Port_3389 -

Port(Destination): 3389 -

Protocol: TCP -

Source: Any -

Destinations: Any -

Action: Allow -
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/troubleshooting/troubleshoot-rdp-nsg-problem

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Spamuel
Highly Voted 4 years, 10 months ago
I would also say to have the source as Service Tag - Internet, so you only allow RDP connections over internet associated IPs rather than from ANY.
upvoted 33 times
planb7000
4 years, 10 months ago
Perfect! That will surely get you extra points.
upvoted 9 times
Nnanna29
4 years, 6 months ago
Definitely! It limits access to only internet instead of 'Any'
upvoted 4 times
...
...
...
hariprasad0511
Highly Voted 3 years, 9 months ago
Its best to configure this way 1. Create VM in a private subnet 2. Create a Azure FW in another subnet 3. Then user NAT-GW to allow traffic from internet to access VM in private subnet via firewall 4. You can configure all rules to reduce attack surface form internet using the azure firewall
upvoted 13 times
...
91743b3
Most Recent 10 months ago
On exam Aug 06 2024
upvoted 2 times
...
nExoR
10 months, 1 week ago
bastion is limiting the attact surface even more than NSG...
upvoted 3 times
...
pentium75
10 months, 1 week ago
We're asked to "minimize the attack surface", and JIT documentation explicitly mentions that JIT about 'reducing the attack surface' while Bastion documentation does not. As the question tend to follow documentation rather than reality, I'd vote for JIT.
upvoted 1 times
...
TheProfessor
1 year, 8 months ago
I think the best is JIT.
upvoted 2 times
...
Pupu86
1 year, 12 months ago
bastion with JIT (assuming Windows Defender is enabled by default)
upvoted 3 times
...
gbx077
2 years, 2 months ago
# Exam question March 24, 2023
upvoted 4 times
...
F117A_Stealth
2 years, 6 months ago
I would actually select Source as "Service Tag" and Set it to "Internet" with Destination to the VM , Protocol as any or TCP and port 3389
upvoted 5 times
...
joanjcanals
2 years, 8 months ago
Could this question be related to the Just in Time VM access feature?
upvoted 2 times
koreshio
2 years, 7 months ago
exactly my thoughts as well. the key point is "Reduce attack surface". for any access to a VM (RDP port 3389, WinRM-Powershell port 5895,5986), if you need to reduce attack surface you need to ensure only Azure AD authenticated users can request access. So the best options would be either Bastion access or even better JIT access.
upvoted 6 times
...
...
Ivanvazovv
2 years, 10 months ago
Bastion or at least JIT. Leaving 3389 open for internet is a bad idea.
upvoted 5 times
OpsecDude
2 years, 8 months ago
I would say JIT as Bastion is different from RDP
upvoted 1 times
mung
2 years, 6 months ago
How Bastion is different from RDP? It is basically built for safe RDP connection
upvoted 2 times
...
koreshio
2 years, 7 months ago
why? they are both used for RDP access. see these resources: https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc https://learn.microsoft.com/en-us/azure/bastion/bastion-connect-vm-rdp-windows
upvoted 1 times
...
...
...
imie
3 years, 5 months ago
in Exam 31 Dec 2021.
upvoted 3 times
...
orallony
3 years, 8 months ago
# IN EXAM - 29/9/2021 - Pass!
upvoted 3 times
...
rainmakerho
3 years, 8 months ago
Enable VM JIT?
upvoted 3 times
...
poplovic
3 years, 9 months ago
JIT is possible or bastion
upvoted 2 times
...
am20
4 years ago
why not using bastion?
upvoted 4 times
am20
4 years ago
https://docs.microsoft.com/en-us/azure/bastion/bastion-overview#architecture
upvoted 2 times
ChinkSantana
3 years, 11 months ago
Bsstion is a good way.. But i doubt this is what the question was asking.
upvoted 2 times
rsamant
3 years, 5 months ago
i think it should be bastion as else we are not limiting the attack surface except opening rdp port directly to internet
upvoted 3 times
...
...
...
...
Fred64
4 years ago
maybe we can deny all other rules as well?
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...