Just-In-Time (JIT) VM access in Microsoft Defender for Cloud controls inbound traffic to virtual machines, reducing exposure to attacks. Microsoft's guidance allows JIT policies to be centrally configured and applied automatically across a resource group using Azure Policy, which provides the lowest administrative overhead.
To meet the requirements:
* Limit request time to two hours: Defender for Cloud JIT policy allows defining a maximum allowed access duration per request.
* Limit protocol to RDP only: The JIT configuration can restrict the protocol and port (TCP/3389 for RDP).
* Minimize administrative effort: Azure Policy can automatically enforce this configuration for all VMs in RG1 without manually setting up each VM.
Other options are less suitable:
* A. PIM controls user privileges, not network access.
* C. Azure Front Door handles web application traffic.
* D. Azure Bastion provides secure RDP/SSH via portal but doesn't manage just-in-time network policies.
# Correct answer: B. Azure Policy