How Do You Limit RDP Exposure on a VM to Four Hours?
You have an Azure virtual machine named VM1. A network security group (NSG) named NSG1 is linked to the network adapter of VM1. VM1 allows inbound RDP (TCP 3389) from an on-premises network. You need to reduce exposure on VM1. The solution must ensure that required RDP access is allowed for only a maximum of four hours. What should you do?
Community Insight
The question tests time-bounded network exposure on a VM; the trap is confusing identity-level controls (Conditional Access) or always-on connectivity solutions (Bastion) with an automated rule that actually expires.
Just-in-time (JIT) VM access in Microsoft Defender for Cloud is the mechanism that opens a temporary, time-bound NSG rule for RDP and closes it automatically after the requested window. This page establishes why JIT — not a static NSG rule, Bastion, or Conditional Access — satisfies the four-hour maximum exposure requirement on VM1.
Choosing "Add a security rule to NSG1" because it seems like the most direct fix — but NSG rules are static, persist until manually changed, and cannot enforce a four-hour maximum window by themselves.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
VM1 currently accepts inbound TCP 3389 from the on-premises network through NSG1 linked to its network adapter, which leaves the port open indefinitely. Just-in-time (JIT) VM access in Microsoft Defender for Cloud is purpose-built for this exact scenario: it denies inbound RDP/SSH by default and, on an approved request, creates a temporary allow rule for the specific source IP and a caller-selected duration, then removes it automatically. Because the JIT policy lets you configure the maximum request window, you can cap RDP access at four hours and guarantee the port closes without manual cleanup. This satisfies both stated requirements — reduced exposure and time-limited RDP.
Why the Other Options Are Wrong
A Conditional Access policy governs authentication and authorization for identities and cloud apps; it does not open or close ports on an NSG attached to a VM's network adapter, so it cannot enforce a four-hour RDP window. Azure Bastion removes the need for a public RDP endpoint by brokering RDP over TLS through the Azure portal, but it is an always-available service and does not itself impose an automatic per-session time limit or expire NSG rules. Adding a security rule to NSG1 is exactly what the environment already does — static allow rules persist until someone edits or deletes them, so there is no automatic expiry after four hours.
Community Comment Notes
One voter, zurc_nosbor, selected D and summarized the elimination logic cleanly: Conditional Access controls identities, Bastion does not enforce an automatic per-session time limit, and "As regras do NSG são estáticas e não expiram automaticamente após 4 horas". That reasoning aligns with Defender for Cloud's JIT model of temporary, auto-revoked allow rules. No commenter argued for A, B, or C, and nothing in the thread contradicts the JIT-based verdict.
Official Reference
Exam Strategy
When a requirement mentions a specific maximum time window for management-port access, look for the control that creates and revokes rules automatically rather than one that merely restricts who can connect. Static NSG rules, Bastion, and Conditional Access are all 'always on' in different layers and cannot satisfy an expiry requirement.
Frequently Asked Questions
Why is adding a security rule to NSG1 not enough to cap RDP at four hours?
NSG rules are static: once created they stay in effect until edited or deleted, so they cannot automatically expire RDP access after four hours the way a JIT request does.
Does Azure Bastion enforce a maximum four-hour RDP session?
No. Bastion removes the public RDP endpoint by brokering connections over TLS, but it does not automatically close or expire the underlying access after a set period; you would still need a time-bound control such as JIT.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →