Protecting Internet-Facing Virtual Machines with Network Security Groups

Correct Answer: D.

Reference:

The security control that includes the recommendation "Internet-facing virtual machines should be protected with network security groups" is D. Secure management ports.

Network Security Groups (NSGs) are a network-level Azure resource that allows you to filter network traffic to and from resources in a Virtual Network. NSGs act as a basic firewall and can be applied to subnets or individual NICs (Network Interface Cards) attached to Azure virtual machines.

When it comes to protecting internet-facing virtual machines, it is essential to use NSGs to restrict traffic to only the necessary ports and protocols. An internet-facing virtual machine is exposed to the internet, which increases the risk of cyber-attacks. As a result, it is critical to restrict traffic to only the necessary ports and protocols.

In this case, secure management ports is the security control that includes the recommendation of using NSGs to protect internet-facing virtual machines. By securing the management ports, you are also securing the virtual machine, as management ports allow access to the virtual machine's operating system, applications, and other resources.

Therefore, the correct answer is D. Secure management ports.