VM & Container Security: AZ-500 Exam Essentials

Just-in-Time (JIT) VM Access

JIT VM access blocks inbound management ports (RDP 3389, SSH 22, WinRM 5985/5986) by default with an NSG deny rule. When a user needs access, they request it through Defender for Cloud. The NSG rule is temporarily allowed for a specified time window and source IP.

Benefits for the exam:

• Eliminates always-open management ports
• Creates an audit trail of who requested access and when
• Time-limited exposure (default 3 hours, configurable to 1 to 24 hours)

Exam tip: JIT VM access is a feature of Defender for Servers (paid plan). It requires the VM to have a public IP or be accessible via NSG.

Disk Encryption

Exam tip: ADE is the only option that encrypts the disk inside the VM OS. SSE encrypts the storage blob, not the OS-visible disk.

Azure Container Registry (ACR) Security

• Enable Admin account: disabled by default. Use managed identities or service principals instead.
• ACR Tasks: build images in Azure. The build environment is ephemeral and isolated.
• Content Trust: sign images with Docker Content Trust. Pulls only verified images.
• Defender for Containers scans ACR images on push for known CVEs.

AKS Security Basics

For the AZ-500: disable local accounts on AKS clusters (use Entra ID authentication), use Azure RBAC for Kubernetes authorization, enable the Microsoft Defender for Containers plan on the subscription. Network policies (Calico or Azure) restrict pod-to-pod traffic.