You have an Azure subscription that has Microsoft Defender for Cloud enabled. You are evaluating the Azure Security Benchmark V3 report. In the…

The Azure Security Benchmark v3 control "Secure management ports" (related to control LT-4: Limit network access to management ports) is designed to mitigate threats by limiting the exposure of management interfaces like RDP and SSH. Microsoft Defender for Cloud's primary recommendation to satisfy this control is to enable just-in-time (JIT) VM access. JIT access works by locking down inbound traffic to these ports by default using Network Security Group (NSG) rules. Access is granted only upon request, for a limited time, from approved IP addresses. Implementing this configuration directly remediates the identified risk, thus increasing the security score for the "Secure management ports" control.

B. No: This is incorrect. The proposed solution directly addresses the core requirement of the "Secure management ports" control. Enabling JIT VM access is the specific, recommended action by Microsoft to remediate this finding and improve the associated security score.

1. Microsoft Learn, "Azure Security Benchmark v3 control LT-4: Limit network access to management ports". Under the "Azure Guidance" section, it explicitly states: "Use Microsoft Defender for Cloud's just-in-time (JIT) VM access feature to request access to the VM. You can use JIT to lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed."

2. Microsoft Learn, "Security controls and their recommendations". This document lists "Secure management ports" as a security control. The recommendations associated with this control include "Management ports of virtual machines should be protected with just-in-time network access control," which directly validates the proposed solution.

3. Microsoft Learn, "Understanding just-in-time (JIT) VM access". This document details the feature, explaining: "When you enable just-in-time VM access, Defender for Cloud creates network security group (NSG) rules which restrict access to management ports so they can't be targeted by attackers." This confirms its function in securing management ports.