Free, with the answer and the reasoning. No account needed.
1. Kestrel Fabrication Works has virtual machines that occasionally require RDP access for administrative tasks, but the security team wants to minimize the attack surface by keeping management ports closed by default and only opening them for a limited time window when an authorized request is approved. What should they enable?
- A. Azure Bastion with a public IP
- B. Just in time VM access through Microsoft Defender for Serverscorrect
- C. A Network Security Group rule allowing RDP from any source
- D. Microsoft Defender for Storage
Just in time VM access, part of Microsoft Defender for Servers, keeps management ports locked down by default and temporarily opens them only after an approved request for a limited time window, minimizing exposure. Azure Bastion provides browser based RDP and SSH without a public IP, but does not itself provide the time bound, request driven access model described. An NSG rule allowing RDP from any source increases exposure rather than reducing it. Defender for Storage protects storage resources, unrelated to VM management ports.
2. Marlstone Bank needs to run a single, untrusted multi-tenant workload with a strong isolation boundary per workload instance, without managing cluster nodes, and specifically wants hypervisor-level isolation for each container group rather than containers sharing a single kernel. Which service natively provides this?
- A. Azure Container Instances, where each container group runs in its own hypervisor-isolated boundarycorrect
- B. Azure Kubernetes Service with all workloads scheduled on a shared node pool
- C. Azure Functions on the Consumption plan
- D. Azure App Service on a shared multi-tenant plan
Azure Container Instances runs each container group in its own hypervisor-isolated boundary by default, giving stronger per-workload isolation than pods that share a kernel on common AKS nodes. AKS on a shared node pool, Functions on Consumption, and App Service on a shared plan all involve workloads sharing underlying compute in ways that provide weaker per-workload isolation than ACI's default model.
3. Thornmere Financial processes highly sensitive financial models and wants to protect data while it is being actively processed in memory, defending against a scenario where even a privileged administrator of the underlying host could not inspect the data. What should they deploy the workload on?
- A. A standard virtual machine with Azure Disk Encryption
- B. A virtual machine behind Azure Firewall with threat intelligence filtering
- C. A virtual machine with Just in time access enabled
- D. Azure confidential virtual machines using a hardware based trusted execution environmentcorrect
Azure confidential virtual machines use hardware based trusted execution environments to encrypt data in use in memory, isolating it so that even privileged host administrators or the hypervisor cannot access it, which matches the requirement. Disk encryption protects data at rest only, not data actively in memory. Azure Firewall protects network traffic, not in memory data. Just in time access reduces network exposure to management ports, it does not protect data in use.