Task 3.2: Implement security for servers and virtual machines (VMs)

• AEnable encryption at host on the original VM, which converts the disks in place

  Incorrect

  In-place conversion from ADE to encryption at host isn't supported.

• BCopy the disks with the Copy option instead of snapshots

  Incorrect

  Disk copies keep the same ADE metadata as snapshots.

• CCreate new managed disks with the Upload method from the VHD data, then build the VM from them

  Correct

  Uploading creates disk objects without the UDE flag that snapshots and copies carry.

• DRe-enable ADE on the new disks, then disable it again before attaching them

  Incorrect

  Running ADE again only adds the same metadata.

Migration from Azure Disk Encryption to encryption at host needs new disks and VMs, because in-place conversion isn't supported. Disks encrypted with ADE carry a Unified Data Encryption (UDE) flag that persists after decryption and is kept by snapshots and Copy-based disk copies, so the guidance creates new managed disks with the Upload method. Linux VMs with ADE-encrypted OS disks need a new VM.

• AJIT works only with firewalls that use classic rules

  Correct

  JIT works with NSGs and with Azure Firewall configured with Rules (Classic).

• BJIT requires Defender for Servers Plan 1 on each VM

  Incorrect

  JIT is a Plan 2 feature, which is already in place.

• CJIT works only on VMs with public IP addresses and no firewall

  Incorrect

  JIT supports VMs protected by Azure Firewall in the same virtual network, with classic rules.

• DJIT must be enabled on the firewall's subnet NSG first

  Incorrect

  The limitation is the Firewall Manager policy model, not a missing NSG.

Just-in-time machine access in Defender for Servers Plan 2 adds deny rules for selected ports to NSGs and Azure Firewall, and opens them for approved requests for a limited time. It doesn't support VMs protected by Azure Firewalls controlled by Azure Firewall Manager: the firewall must be configured with Rules (Classic), not Firewall Policy.

• AAn Azure Policy deny assignment for the extension resource types on the Arc resources

  Incorrect

  A subscription Owner can exempt or remove the assignment from Azure.

• BA custom Azure role that excludes Microsoft.HybridCompute/machines/extensions/write

  Incorrect

  Owners and other administrators can still assign themselves broader roles.

• CA resource lock on each Arc-enabled server resource

  Incorrect

  Owners can remove locks, and locks don't block extension installation by type.

• DA local extension block list set with azcmagent on each server

  Correct

  Local allow and block lists can't be overridden from Azure, even by Owner or Global Administrator.

Extensions on Arc-enabled servers are managed from Azure, and Custom Script Extension or Run Command run with Local System or root rights. Allow lists and block lists are configured locally on each server with azcmagent config, so nobody in Azure, not even a user with Owner or Global Administrator permissions, can install a blocked extension.

• ADisable Defender for Servers on each development VM

  Incorrect

  Disabling the plan per resource removes protection, including the Defender for Endpoint EDR that Plan 1 keeps.

• BDowngrade the env=dev machines to Plan 1 with the script or a policy assignment

  Correct

  In a Plan 2 subscription, a script or policy can downgrade a group of machines, selected by tag or resource group, to Plan 1.

• CSwitch the subscription to Plan 1, then enable Plan 2 on each production VM

  Incorrect

  Plan 2 can't be enabled at the resource level, so production would lose Plan 2.

• DMove the development VMs to a subscription that runs Plan 1

  Incorrect

  It would work, but the requirement rules out moving VMs between subscriptions.

Microsoft recommends enabling Defender for Servers at subscription level and allows resource-level changes for granularity. Plan 1, which focuses on EDR through the Defender for Endpoint integration, can be enabled and disabled per resource. Plan 2 can be disabled per resource but not enabled per resource. If Plan 2 is on in a subscription, a script or policy assignment can downgrade a group of machines to Plan 1, selecting them by a resource tag or a resource group.

• ARecording needs a second storage container for native sessions

  Incorrect

  Recording supports one container or storage account at a time.

• BThe SAS URL on the container expired for native sessions only

  Incorrect

  A shared SAS problem would affect browser sessions too.

• CSession recording isn't available for native client connections

  Correct

  Only sessions through the portal experience are recorded today.

• DNative client sessions are recorded in the VM's own event log

  Incorrect

  Recordings are stored in the configured blob container, and native sessions aren't recorded.

Bastion graphical session recording, a Premium SKU feature, records RDP and SSH sessions made through the bastion host and stores them in a blob container. It isn't available through the native client, supports one container at a time, and can't yet be combined with Microsoft Entra ID authentication for RDP sessions in the portal.

• AMarch 31, 2026

  Incorrect

  The retirement date is later.

• BSeptember 30, 2027

  Incorrect

  The retirement date is later.

• CSeptember 15, 2028

  Correct

  After that date, ADE-encrypted disks fail to unlock after VM reboots.

• DIt isn't being retired

  Incorrect

  Microsoft has scheduled its retirement.

Azure Disk Encryption is scheduled for retirement on September 15, 2028. ADE-enabled workloads keep running until then, but after that date encrypted disks fail to unlock after reboots, so all ADE-enabled VMs, including backups, must migrate to encryption at host.

• A3 hours

  Correct

  The default maximum allowed access is 3 hours.

• B30 minutes

  Incorrect

  The default allows longer.

• C24 hours

  Incorrect

  The default is shorter.

• DUntil the user closes the connection

  Incorrect

  Access always ends after the approved period.

Just-in-time access opens the selected ports only for the requested time; with default settings, the maximum allowed access per request is 3 hours, after which Defender for Cloud restores the rules.

• APer machine, with each machine's own excess billed

  Incorrect

  The allowance isn't enforced per machine; one machine can exceed 500 MB without a charge.

• BAs a daily total of machines times 500 MB, across the subscription

  Correct

  The total is calculated for all machines in the subscription, so ingestion is free while their combined data stays within it.

• COnce per Log Analytics workspace, whatever the number of machines

  Incorrect

  The allowance grows with the number of machines.

• DAs a monthly pool of 15 GB per machine

  Incorrect

  The allowance is calculated daily, not monthly.

With Defender for Servers Plan 2, the daily allowance equals the number of machines times 500 MB. It's calculated for all machines in a subscription, not enforced per machine, so there's no charge while the combined eligible data stays within it. It applies at the Log Analytics workspace level when Plan 2 is enabled on the workspace the machines report to, for security data types such as SecurityEvent and SecurityAlert.

• AAudit

  Incorrect

  Audit only reports; it doesn't apply settings.

• BApplyAndAutoCorrect

  Incorrect

  That re-applies settings when they drift.

• CDeployIfNotExists

  Incorrect

  That's an Azure Policy effect, not an assignment type.

• DApplyAndMonitor

  Correct

  It applies the configuration once and then monitors for drift.

Machine Configuration has three assignment types: Audit reports compliance, ApplyAndMonitor applies the configuration once and reports drift without correcting it, and ApplyAndAutoCorrect re-applies the configuration at the next evaluation when it drifts.