Microsoft Security Operations AnalystMitigate threats using Microsoft Defender for CloudMedium
A security analyst is investigating a high-severity alert in Microsoft Defender for Cloud for an Azure virtual machine. The alert indicates a potential brute-force attack against an RDP port. The analyst wants to quickly restrict inbound access to the RDP port for this specific VM to only authorized IP addresses for a limited time, without permanently changing the Network Security Group (NSG) rules. Which Microsoft Defender for Cloud feature can achieve this temporary, on-demand restriction?
- AJust-in-Time (JIT) VM Access
- BAdaptive Network Hardening
- CNetwork Security Group (NSG) recommendations
- DAzure Firewall Policy
Show answer & explanationAnswer & explanation
Correct answer: A. Just-in-Time (JIT) VM Access
Just-in-Time (JIT) VM access allows temporary, controlled access to management ports of Azure VMs only when needed, significantly reducing the attack surface. It's perfect for responding to a brute-force attack by temporarily locking down the port.
Why the other options are wrong
- B. Adaptive Network Hardening provides recommended NSG rules based on traffic analysis, but doesn't offer on-demand, temporary access.
- C. NSG recommendations suggest permanent rule changes, not temporary access control.
- D. Azure Firewall Policy provides centralized firewall management but doesn't offer the on-demand, temporary access control for individual VM management ports like JIT.
Just-in-Time (JIT) VM Access
Just-in-Time (JIT) VM access in Microsoft Defender for Cloud helps reduce the attack surface of virtual machines by locking down inbound traffic to management ports. Access is granted temporarily, on demand, and only to specified source IP addresses or ranges.
- Locks down management ports (e.g., RDP, SSH).
- Access is granted only for a limited time and to approved IPs.
- Significantly reduces exposure to brute-force attacks and other threats.
Memory trick: Only when needed, only for a bit, JIT access makes the port fit.