Knowledge check

1.

A security engineer enables JIT VM access on an Azure virtual machine. What happens to the NSG rule for RDP port 3389 immediately after JIT is enabled on that VM?

The port remains open to the same source addresses as before; JIT takes effect only after the first approved request

The port is locked down—inbound access on port 3389 is blocked until an approved JIT request opens it

The port opens for the requesting user's source IP address for a default period of 3 hours

2.

A user submits a JIT access request from the Azure portal for a JIT-enabled VM. What information must the user provide in the access request?

The ports to open, the source IP range, and the duration of access

Only the port number—Defender for Cloud automatically fills in the source IP and duration from the policy defaults

The port to open, the duration, and a PIM activation code for the Security Admin role

3.

An organization wants to ensure all new Azure VMs have JIT access configured automatically without manual intervention after deployment. Which approach works at scale?

Configure JIT from each VM's Configuration page after deployment

Assign the Azure Policy definition 'Management ports of virtual machines should be protected with just-in-time network access control'

Enable Defender for Servers Plan 2 at subscription scope—JIT is automatically configured for all VMs

Check your knowledge

Feedback