AZ-104 Practice Question 17: Bastion No Public IP
Microsoft Azure Administrator Associate (AZ-104) · Test 2 · question 7 of 10
A new security standard takes effect next week:
- No virtual machine may have a public IP address. - No network security group may allow inbound TCP 3389 or 22 from the internet. - Administrators must not install any additional client software on their laptops.
Administrators still need RDP and SSH access to VMs in VNet-Prod. What should you deploy?
Show answer and explanation
Answer:
Azure Bastion is "a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to your virtual machines directly over TLS from the Azure portal." It is deployed into its own dedicated AzureBastionSubnet and reaches every VM in the virtual network over its private IP, so "when you connect via Azure Bastion, your virtual machines don't need a public IP address, agent, or special client software." The browser session runs over TLS on port 443, so no inbound 3389 or 22 rule from the internet is required and the VMs are shielded from port scanning.
Option B breaks two of the three constraints outright: the VMs get public IP addresses and an NSG rule permits 3389 from an internet source range.
Option C only concentrates the exposure. The jump box itself needs a public IP and an internet-facing RDP rule, which is exactly what the standard forbids, and it becomes the single host worth attacking.
Option D is a workable remote-access design in general, but it fails the stated constraint that no extra client software may be installed on administrator laptops, and it means deploying and paying for a gateway when portal-based access is what is actually needed.
Reference: What is Azure Bastion?