Exam AZ-500 topic 3 question 30 discussion

answer is correct: The service will detect where the temporary exceptions need to be created and act accordingly. The only requirement is that there IS an NSG either on the vmNIC or the subnet to which the required exceptions can be added as required. If there is no NSG then a warning is surfaced via Azure Security Center. https://www.itprotoday.com/iaaspaas/faqs-closer-look-requirements-and-functions-just-time-vm-access-azure

correct answer

Answer is correct , please note that besides NSG , firewall can also come to this question. Either NSG or Azure Firewall integrated can be protected by JIT

VMs that don't support JIT because: Missing network security group (NSG) https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage#work-with-jit-vm-access-using-microsoft-defender-for-cloud

because these VMs have NSGs protecting them

C. VM1, VM3 and VM4 only

VM1, VM3 and VM4 only

Answer is correct. JIT works only when NSW associated at subnet or VM

In exam 15-July-2022

In exam 15-July-2022

C is correct answer.

Answer is correct. JIT works only when NSW associated at subnet or VM

answer is correct...NSG at either the subnet or VM interface level

The answer is correct A network security group (NSG) contains a list of security rules that allow or deny network traffic to resources connected to Azure Virtual Networks (VNet). NSGs can be associated to subnets or individual network interfaces (NIC) attached to VMs.

To get JIT working you need an NSG either on the subnet level or VM. VM1, VM2, and VM3 have an NSG on the subnet level. VM4 has an NSG on the NIC, so JIT is also working for VM4? What do I see wrong here?

Correct!

A NSG required for JIT