Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Configuring just-in-time (JIT) VM access in Microsoft Defender for Cloud best meets the requirements. JIT keeps selected inbound management ports (such as 3389 for RDP) blocked by default and opens them only after an administrator submits and receives approval for a time-limited request-three hours is within the configurable range (up to 24 hours). When the approved window expires, Defender for Cloud automatically removes the temporary allow rule and re-applies the default deny policy. Every JIT request-approved or denied-is written to the Azure Activity log for auditing.

Azure Bastion avoids exposing RDP on each VM but permanently keeps TCP 443 open on the Bastion host and does not enforce a per-connection time window; sessions can persist as long as the user remains connected. A point-to-site VPN secures traffic but does not automatically close or time-limit RDP port access inside the virtual network. Publishing RDP via Microsoft Entra Application Proxy is intended for Remote Desktop Services environments with an RD Gateway and introduces additional deployment overhead, so it is not the least-effort solution for direct VM troubleshooting in Azure.