A contractor requests just-in-time access to a lock-chamber VM from a coffee-shop IP that is not on the allowed prefix and leaves the window open for days. Which JIT configuration should the security engineer enforce?
Select an answer to reveal the explanation.
Short Explanation
JIT isn’t a weekend pass from the coffee shop. Lock the allowed source, the ports, and a short max window—when time’s up, the NSG deny comes back.
Full Explanation
Hardening JIT means configuring allowed source IPs, the permitted management ports (such as 22 or 3389), and a short maximum request duration so the temporary NSG allow is revoked when the window ends. A contractor on a coffee-shop IP outside the approved prefixes should be denied; multi-day windows defeat the “just-in-time” purpose for lock-chamber VMs. Tight source, port, and duration settings are the control the security engineer enforces.
Allowing any source IP with multi-day duration and relying on Entra PIM alone to close the NSG fails by concept: PIM governs role activation, not automatic revocation of JIT NSG allows when a shift ends. Disabling source IP checks and permanently allowing 3389 from AzureBastionSubnet without a time limit after the first success converts JIT into a standing allow and erases the time box. Requiring Global Administrator activation in PIM instead of JIT on the VM confuses directory-wide privilege with per-VM network JIT and is far too broad for chamber access.
Exam caveat: JIT max duration is capped by policy you set; operators cannot extend beyond that maximum on an ad hoc coffee-shop request. Operational check: attempt a JIT request from a disallowed source and confirm rejection; then request from an allowed prefix with a short duration and confirm the NSG allow disappears when time expires.