Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Limiting Blast Radius With Least Privilege JIT
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is migrating several workloads to Azure and wants to align its access management strategy with the Zero Trust security model. The primary goal is to minimize the potential damage (blast radius) if user credentials are compromised and prevent unauthorized lateral movement across cloud resources.
Which strategy best aligns with the Zero Trust model to minimize breach risk in Azure?
Explanations
Rely strictly on perimeter network firewalls and grant implicit trust to all traffic within the virtual network
Rely strictly on perimeter network firewalls and grant implicit trust to all traffic within the virtual network
What Perimeter-Based Security Is
Perimeter-based security focuses on securing the outer boundary of a network using firewalls, routing appliances, and edge gateways. Once traffic successfully enters the internal virtual network (VNet), resources inside that network boundary are treated with implicit trust.
Why It Doesn't Meet the Requirement
Implicit internal trust is the exact opposite of the Zero Trust model. If an attacker breaches the perimeter through phishing, compromised endpoints, or software vulnerabilities, they can freely traverse internal systems without encountering additional identity checks or micro-segmentation controls.
Key Characteristics and Limitations
- Monolithic Defense: Creates a hard outer shell but a soft, vulnerable interior.
- High Lateral Movement Risk: Enables threat actors to move laterally between workloads inside the virtual network unchecked.
- Lack of Granular Control: Does not validate individual requests or inspect internal east-west traffic adequately.
This Answer Would Be Correct If
The scenario called for a legacy perimeter security model that relies exclusively on boundary-level defense without modern internal segmentation or identity-based access verifications.
Bypass identity authentication and conditional access checks when requests originate from internal corporate IP addresses
Bypass identity authentication and conditional access checks when requests originate from internal corporate IP addresses
What IP-Based Authentication Bypassing Is
Bypassing authentication or Conditional Access controls based on source IP address involves automatically trusting any connection that originates from within known corporate IP ranges, skipping multi-factor authentication and identity verification.
Why It Doesn't Meet the Requirement
A fundamental tenet of Zero Trust is explicit verification, which mandates verifying every access request regardless of where it originates. Treating internal network locations as inherently safe creates severe vulnerabilities, as internal networks can be compromised or spoofed.
Key Characteristics and Limitations
- False Assumption of Safety: Assumes that location equals identity and integrity.
- Susceptible to Internal Threats: Ignores risks from malicious insiders or compromised corporate machines on the local network.
- Disables Advanced Protections: Bypasses critical contextual signals such as device health, user risk level, and anomalous behavior patterns.
This Answer Would Be Correct If
The goal was to simplify user sign-in convenience on a legacy local network at the complete expense of access security and Zero Trust alignment.
Enforce least-privileged access and utilize just-in-time (JIT) access controls
Enforce least-privileged access and utilize just-in-time (JIT) access controls
What Least Privilege and Just-In-Time Access Is
The principle of least privilege ensures that users, applications, and services receive only the minimum level of access necessary to complete their specific tasks. Paired with just-in-time (JIT) access controls, permissions are granted dynamically and temporarily, expiring automatically once the required operational window closes.
How It Meets the Zero Trust Requirement
Under the Zero Trust framework, the core guiding philosophy is "never trust, always verify" and "assume breach." Implementing least privilege directly limits the scope of what an identity can access. If an account is compromised, the attacker's ability to move laterally or access sensitive systems is severely restricted because the identity lacks broad or persistent permissions.
Key Advantages and Capabilities
- Reduced Attack Surface: Minimizes the number of persistent standing privileges across cloud environments.
- Minimized Blast Radius: Confines potential unauthorized actions strictly to the narrow permissions assigned to that identity.
- Automated Revocation: Eliminates long-lived access risks by removing elevated permissions after a predefined timeframe.
- Auditability and Governance: Every privilege elevation request and temporary grant produces detailed telemetry and activity logs.
Why This Is Optimal
Adopting least privilege and JIT access represents a foundational pillar of modern cloud security. Unlike traditional perimeter-based security architectures that assume trust within an internal network boundary, this approach constantly validates identity, context, and explicit necessity before granting minimal required access.
Assign permanent subscription-wide Owner roles to administrative team members to prevent workflow friction
Assign permanent subscription-wide Owner roles to administrative team members to prevent workflow friction
What Permanent Subscription Owner Roles Are
The Owner role in Azure provides full access to manage all resources within an assigned scope, including the ability to grant and delegate access to other users. Assigning permanent Owner privileges gives administrators broad, unrestricted control over the entire subscription at all times.
Why It Doesn't Meet the Requirement
This approach directly violates the Zero Trust principles of least privilege and assuming breach. If an account with persistent Owner permissions is compromised, the adversary gains unrestricted control over every workload and data store within that subscription, maximizing the breach's blast radius rather than minimizing it.
Key Characteristics and Limitations
- High Vulnerability to Compromise: Standing administrative accounts represent prime targets for credential theft and phishing attacks.
- No Temporal Boundaries: Permanent role assignments leave elevated rights active 24/7, even when no administrative tasks are being performed.
- Governance Non-Compliance: Security standards recommend strictly limiting the number of subscription owners to minimize organizational risk.
This Answer Would Be Correct If
This option would only be appropriate in a non-production sandbox environment where security isolation is unnecessary and testing unrestricted management operations across multiple resource types is the primary objective.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra ID Protection
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Zero Trust Least Privilege Access
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Managed Identities
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Conditional Access
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Advisor Recommendations
Describe the purpose of Azure Advisor
IntermediateAZ-800 Administering Windows Server Hybrid Core Infrastructure Exam
Azure File Sync Event Logs and Azure Monitor
Configure and manage Azure File Sync
Last updated Validated