AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure VPN Gateway

  Why it's wrong here

  Azure VPN Gateway establishes an encrypted IPsec/IKE tunnel between an on-premises network or client and the virtual network, enabling connectivity to the VNet address space. However, it is a network-layer connectivity service, not a session gateway; administrators still need a remote desktop client or SSH client and a reachable IP address for each VM. It doesn't provide browser-based, portal-integrated management sessions, and it doesn't prevent VMs from requiring public IPs if they aren't reachable over the tunnel. Thus it doesn't fulfill the specific 'connect from browser' requirement.

  When this WOULD be correct

  An exam question where administrators need to securely connect on-premises networks to Azure VMs over the internet, and installing a VPN client on admin laptops is acceptable, would make Azure VPN Gateway the correct answer.

• ✗

  Azure Load Balancer

  Why it's wrong here

  Azure Load Balancer is a Layer-4 traffic distribution service that spreads incoming requests across backend pool VMs and can apply health probes and NAT rules. While inbound NAT rules can technically forward a frontend port to a VM's RDP/SSH port, that exposes management endpoints through the load balancer's public frontend and adds configuration overhead per VM. It provides no authentication, no session recording, and no browser-based console, so it isn't designed or recommended as a secure shell access solution. In contrast, Azure Bastion is purpose-built for secure administrative connectivity.

  When this WOULD be correct

  A question requiring high availability and load distribution for web applications across multiple VMs, where the goal is to distribute incoming traffic and ensure fault tolerance, not to provide secure administrative access.

• ✗

  A network security group with RDP and SSH rules

  Why it's wrong here

  An NSG is a distributed firewall that filters allowed or denied inbound and outbound traffic at the subnet or NIC level using rules such as 3389 (RDP) and 22 (SSH). Configuring allow rules only opens a path if the VM has a public IP or a routed private address that the administrator can reach; it does not create a secure, auditing-friendly management plane. Opening RDP/SSH to the internet can expose administrative ports to brute-force attacks. Therefore, an NSG is a supporting security control, not the actual secure connectivity mechanism required.

  When this WOULD be correct

  This option would be correct in a scenario where VMs already have public IP addresses and the question asks how to restrict inbound RDP/SSH access to specific source IPs or deny all inbound traffic except from a management subnet, using NSG rules.

• ✓

  Azure Bastion

  Why this is correct

  Azure Bastion provides secure browser-based RDP and SSH to VMs that have no public IP addresses. It keeps management traffic inside Azure and avoids exposing administrative ports to the internet or requiring a client VPN on the administrator's device.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question