AZ-305 Exam - Question 29

Question

HOTSPOT -You have an Azure subscription that contains a virtual network named VNET1 and 10 virtual machines. The virtual machines are connected to VNET1. You need to design a solution to manage the virtual machines from the internet. The solution must meet the following requirements:✑ Incoming connections to the virtual machines must be authenticated by using Azure Multi-Factor Authentication (MFA) before network connectivity is allowed. ✑ Incoming connections must use TLS and connect to TCP port 443. ✑ The solution must support RDP and SSH. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:.

Examice · Accepted Answer

Box 1: Just-in-time (JIT) VN accessLock down inbound traffic to your Azure Virtual Machines with Microsoft Defender for Cloud's just-in-time (JIT) virtual machine (VM) access feature. This reduces exposure to attacks while providing easy access when you need to connect to a VM. Note: Threat actors actively hunt accessible machines with open management ports, like RDP or SSH. Your legitimate users also use these ports, so it's not practical to keep them closed. When you enable just-in-time VM access, you can select the ports on the VM to which inbound traffic will be blocked. To solve this dilemma, Microsoft Defender for Cloud offers JIT. With JIT, you can lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed. Box 2: A conditional Access policy that has Cloud Apps assignment set to Azure Windows VM Sign-InYou can enforce Conditional Access policies such as multi-factor authentication or user sign-in risk check before authorizing access to Windows VMs in Azure that are enabled with Azure AD sign in. To apply Conditional Access policy, you must select the "Azure Windows VM Sign-In" app from the cloud apps or actions assignment option and then use Sign-in risk as a condition and/or require multi-factor authentication as a grant access control. Reference:https://docs. microsoft. com/en-us/azure/defender-for-cloud/just-in-time-access-overview https://docs. microsoft. com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows.

Gowind · Answer

1. Answer is Azure Bastion.
https://docs.microsoft.com/en-us/azure/bastion/bastion-overview
It provides secure and seamless RDP/SSH connectivity to your virtual machines directly from the Azure portal over TLS. 
While JIT access allows access via RDP or SSH, incoming connections is not TLS tcp 443 (but RDP or SSH when the inbound port is temporarily authorized) 
https://docs.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-avm%2Cjit-request-asc
2. Second is correct
https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows
Enforce Conditional Access policies
You can enforce Conditional Access policies, such as multifactor authentication or user sign-in risk check, before you authorize access to Windows VMs in Azure that are enabled with Azure AD login. To apply a Conditional Access policy, you must select the Azure Windows VM Sign-In app from the cloud apps or actions assignment option. Then use sign-in risk as a condition and/or require MFA as a control for granting access.

alxm8 · Answer

1. Azure Bastion
2. Conditional Access Policy that has the cloud apps assignment set to Microsoft Azure management

Azure bastion client access is authorized and authenticated when trying to log into the Azure portal. You can enable MFA on the Azure portal access by using the Conditional access policy for Microsoft Azure Management. We use this currently at work, it works very well!

Azure bastion proxies the web portal requests via https to the servers running in the VNET.

ACM13 · Answer

For the answer is: Azure Bastion & Conditional access policy microsoft azure management

BShelat · Answer

I previously gave two reasons to rule out Azure Bastion as an answer. One more additional reason to rule it out:  Reason 3:  We need to design a solution to manage the virtual machines from the internet.  Azure Bastion enable VM access on private IP address range NOT on Public IP range i.e. not on internet.

varinder82 · Answer

Final Answer:
1. Azure Bastion
2. Conditional Access Policy that has the cloud apps assignment set to Microsoft Azure management

s8y · Answer

box1: JIT (The solution must support RDP and SSH), requirement for TLS referees to triggering/enabling JIT (from azure portal). It can't be bastion since it will keep rdp/ssh listener constantly running/accessible over internet (while connection must only appear on request that involves mfa)

ncseffai · Answer

For those who are doubting the second answer. If you look at this link, the azure bastion is not mentioned among the services. Hence it will not trigger the MFA authentication. You need to go with Windows VM Sign-in
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps#microsoft-azure-management

fodocel235 · Answer

1. Answer is Azure Bastion. You can reach Bastion via https. 
2. Answer is Conditional Access Policy that has the Cloud apps assignment set to Microsoft Azure Management, that's enforces the MFA for the Bastion services. Even it's not mentioned that the VM's are only Windows VM's. Maybe there are also Linux VM's.

Maurice95000 · Answer

1. Answer is Azure Bastion.

Elecktrus · Answer

Box 2 is a bit tricky. 
It is not mentioned anywhere that the virtual machines are Windows (Azure Windows VM Sign-In only works in windows). And you need permit ssh access (that is typically used in Linux), so we are not sure that machines are only windows.
This option only works for windows.
But MFA for MAnagement Acces is only to to protect privileged resources (Azure Portal, CLI, etc) not for login to machines. I can use a RDP or SSH client from my personal PC to connect to this VM, and then the policy is useless.
So, there isnt a fully correct answer. 
I will choose Windows VM Sign-in, because it will work sometimes (if the VM are windows)

serget12 · Answer

Not sure about Bastion, the reason I see for using Bastion if for the TLS/443 but that is all about sending data.  For connection, which will be done over rdp/ssh, 3389/22, you would use JIT.  Going to go with JIT.  for the second, don't think the correct option is listed so have to go with the next best option.  Of course, Cloud apps is being removed. Could be an old question.

learning93 · Answer

Azure Bastion:

Azure Bastion is a managed PaaS service that allows secure and seamless RDP and SSH access to your virtual machines directly from the Azure portal without the need for a public IP address on the VMs.
It uses TLS encryption (HTTPS) on port 443 for secure access.

husam421 · Answer

Answer is Azure Bastion

The JIT VM access page opens listing the ports that Defender for Cloud recommends protecting:

22 - SSH
3389 - RDP
5985 - WinRM
5986 - WinRM

rajeshrj1981 · Answer

Answer is Azure Bastion and Conditional Access Policy with "Cloud apps assignment set to Windows VM signin":

BShelat · Answer

I would rule out "Azure Bastion" for following reasons.
1) Question text does not indicate the existence of Azure Bastion subnet in VNET1. Without Azure Bastion subnet in virtual network Bastion host cannot be deployed in virtual network.
2) Answer area also does not mention anything about "Create Azure Bastion subnet and host.

So for above reasons I will go with JIT VM

DeinosK · Answer

#1 is bastion
https://www.youtube.com/watch?v=DHiZbIks9i0

23169fd · Answer

To provide access to virtual machines on VNET1, use:
Azure Bastion
Azure Bastion provides secure and seamless RDP and SSH connectivity to virtual machines directly in the Azure portal over TLS (TCP port 443), ensuring secure access without exposing the VMs to the public internet.

To enforce Azure MFA, use:
A Conditional Access policy that has the Cloud apps assignment set to Azure Windows VM Sign-In
A Conditional Access policy ensures that users must authenticate with MFA before accessing the virtual machines, enhancing security by requiring multi-factor authentication for access.

AZ-305 Exam - Question 29

Discussion