4.2. Implement Security for Servers and Virtual Machines

💡 First Principle: A virtual machine is the most traditional compute surface on this exam, but "traditional" doesn't mean "solved" — the layers introduced here (encryption, access timing, hybrid reach, detection, and configuration drift) each address a distinct way a VM can be compromised even when the others are configured correctly.

Mental model: think in terms of when each control applies — disk encryption and secure boot protect the VM at rest and at boot time; JIT access and Bastion control when and how someone can reach it; Arc extends the same controls to machines outside Azure entirely; Defender for Servers and agentless scanning watch continuously; and Machine Configuration keeps the OS-level configuration from silently drifting out of the baseline you set.

⚠️ Common Misconception: Just-in-time VM access does not remove the need for NSGs. JIT temporarily narrows an NSG rule to allow access only during an approved window from an approved source — it works with NSGs by modifying them, not as a standalone replacement. A broad, unrelated NSG rule elsewhere still exposes the VM regardless of JIT being enabled.