Monitor networks

Wendover Clinics has Microsoft Defender for Servers Plan 2 enabled on its subscription. Its Microsoft Defender for Cloud secure score shows the recommendation 'Management ports of virtual machines should be protected with just-in-time network access control' affecting 12 virtual machines in vnet-clinic. All 12 VMs have NSG rules that allow RDP from the internet on port 3389 so that administrators can connect. The company wants to remediate the recommendation while keeping administrative access, with minimal additional cost.

What should you do?

1. AEnable just-in-time VM access on the 12 VMs so that the NSG denies 3389 by default and opens it only for approved requests from specific source addresses for a limited time.Just-in-time access is exactly what the recommendation asks for: it locks the management port in the NSG and opens it temporarily on request, preserving administrator access while removing the standing internet exposure. It is included in the Defender for Servers Plan 2 that is already enabled.
2. BDeploy Azure Bastion in vnet-clinic and remove the inbound 3389 rules.Bastion also resolves the exposure and is a strong design, but the Bastion host adds its own hourly charge, so it is not the minimal-additional-cost answer when JIT is already included in the existing plan.
3. CChange the NSG rules to allow 3389 from any source but move them to a lower priority.Priority changes do not alter the fact that the port is open to the internet; the recommendation remains unhealthy.
4. DExempt the 12 VMs from the recommendation so that the secure score increases.An exemption hides the finding without reducing risk and is intended for accepted or mitigated-elsewhere cases, not for suppressing real exposure.

Bramblewood Media exposes a public website through an Application Gateway v2 with a WAF, plus three other Standard public IP addresses, all in one virtual network vnet-web. The company has suffered volumetric attacks and now requires adaptive tuning, attack mitigation reports and flow logs during attacks, access to the Rapid Response team and cost protection for scale-out during an attack. The security team also wants an alert whenever mitigation starts. Cost is secondary to these requirements.

Which two actions should you perform? Each correct answer presents part of the solution.

1. ACreate an Azure DDoS Network Protection plan and enable it on vnet-web.Network Protection applies to every public IP in the virtual network and is the only tier that includes DDoS Rapid Response, cost protection and the WAF discount, as well as mitigation reports and flow logs.
2. BCreate a metric alert on each public IP address for the metric Under DDoS attack or not.The Under DDoS attack or not metric changes to 1 when mitigation begins; alerting on it notifies the team at the start of an attack. Diagnostic settings can also stream notification, mitigation report and flow log categories.
3. CEnable Azure DDoS IP Protection on each of the public IP addresses individually.IP Protection provides the same mitigation engine and telemetry per IP at lower cost, but it does not include Rapid Response support, cost protection or the WAF discount, which the scenario requires.
4. DRely on the default infrastructure-level DDoS protection that is always enabled for Azure public IPs.Infrastructure protection defends the Azure platform, not individual applications; it offers no tuning, telemetry, reports or alerts for your resources.
5. EEnable Microsoft Defender for Cloud attack path analysis on vnet-web so that attacks are detected.Attack path analysis is a posture management feature that finds exploitable configuration chains; it does not detect or mitigate DDoS traffic.

Dalloway Logistics has Defender CSPM enabled across 9 subscriptions. After a change-control failure, the security team must produce within an hour a list of every virtual machine in the tenant that is exposed to the internet on port 3389 and that also has a managed identity with Contributor permissions on any subscription. The team does not want to write Kusto queries against each subscription or export NSG rules by hand.

What should you use?

1. ACloud Security Explorer, building a query that starts with Virtual machines, adds the condition Exposed to the internet with port 3389, and adds the condition Has permissions to a subscription with the Contributor role.Cloud Security Explorer runs graph queries across all onboarded subscriptions, combining network exposure, identity and permission insights in one result set without any Kusto or manual exports.
2. BAzure Resource Graph Explorer with a Kusto query joining Microsoft.Compute/virtualMachines to Microsoft.Network/networkSecurityGroups.Resource Graph can list VMs and NSGs, but it does not compute effective internet exposure or evaluate the permissions of managed identities, and the scenario rules out writing Kusto.
3. CNetwork Watcher effective security rules on each VM NIC, exported to a spreadsheet.Effective security rules show the rules for one NIC at a time; collecting them for every VM in 9 subscriptions by hand and then cross-referencing permissions is exactly the manual work the team wants to avoid.
4. DAzure Monitor Network Insights topology view filtered to show only internet-facing VMs.Network Insights shows topology and health; it has no knowledge of role assignments or managed identity permissions.

Castlereagh Bank enabled the Defender CSPM plan. Attack path analysis shows the path 'Internet exposed VM has high severity vulnerabilities and read permission to a Key Vault' for vm-batch07 in vnet-core. Investigation shows the VM has a Standard public IP, an NSG rule allowing TCP 22 from Any, a system-assigned managed identity with Key Vault Secrets User on kv-core, and an unpatched SSH service. The bank wants to break the attack path with the single change that removes the entry point, without affecting the VM's scheduled jobs that read secrets from kv-core.

What should you do?

1. ARemove the public IP address from vm-batch07 and restrict the NSG so that TCP 22 is allowed only from the management subnet, then verify the attack path disappears on the next analysis.The entry node of the path is internet exposure. Removing the public IP and the Any-source SSH rule eliminates the exposure while leaving the managed identity and Key Vault access intact, so the batch jobs keep working.
2. BRemove the Key Vault Secrets User role assignment from the managed identity of vm-batch07.This breaks the path at the target end but stops the scheduled jobs from reading secrets, which the scenario does not allow, and leaves the VM exposed to the internet.
3. CEnable Azure DDoS IP Protection on the VM's public IP address.DDoS protection defends against volumetric attacks; it does nothing about an exploitable SSH service exposed to the internet or the lateral path to Key Vault.
4. DDismiss the attack path in Defender for Cloud because the VM only runs batch jobs.Dismissing suppresses the finding without changing the exposure; the vulnerability and internet entry point remain.