Question

A financial services company is executing the Zero Trust adoption framework across its Azure environment. The infrastructure team runs thousands of VMs and container hosts. Leadership wants to reduce standing exposure of management ports and detect configuration drift on workloads, aligning to the Zero Trust 'Infrastructure' pillar. As the cybersecurity architect, which combination of controls best fulfills the Infrastructure pillar goals of least-privilege access and telemetry-driven anomaly detection for these workloads?

Accepted Answer

Enable Just-in-Time VM access and adaptive application controls via Defender for Servers, and stream workload behavioral telemetry to detect drift and anomalies

Answer

Deploy a site-to-site VPN to all management subnets and require domain-joined jump servers for all administrative sessions

Answer

Apply Azure Policy to enforce resource tagging standards and enable diagnostic settings on every subscription

Answer

Configure Conditional Access policies requiring MFA for all user sign-ins and block legacy authentication protocols