AZ-104 Deploy and Manage Azure Compute Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure Bastion

  Why this is correct

  Azure Bastion is a fully managed PaaS service that provides secure, seamless RDP and SSH access to virtual machines directly through the Azure portal over TLS. Because it connects to the VM's private IP address, no public IP address or inbound internet-facing rule is required on the VM's NSG, eliminating the need for a VPN client or a jump box. It also supports session monitoring, multi-factor authentication (via Azure AD integration), and is deployed in a dedicated AzureBastionSubnet, making it the correct service for interactive browser-based administrative access.

• ✗

  VPN Gateway

  Why it's wrong here

  VPN Gateway establishes encrypted IPsec/IKE tunnels between on-premises networks and your Azure VNet (site-to-site) or individual devices (point-to-site), thereby extending the VNet's network boundaries. Although it can be a prerequisite for certain remote-access scenarios, it still requires the user to install and configure a VPN client and then use a separate RDP/SSH client to reach the VM's private IP. It is not a browser-based management service and does not natively provide the interactive console-like session or authentication layer needed for VM administration.

  When this WOULD be correct

  A question requiring site-to-site or point-to-site encrypted connectivity from on-premises networks to Azure VNets, where the client installs a VPN client (not browser-based) and VMs may have private IPs.

• ✗

  Load Balancer

  Why it's wrong here

  Azure Load Balancer operates at Layer 4 of the OSI model and forwards TCP/UDP traffic to backend pool instances based on load-balancing rules and health probes. It is designed to distribute workloads across multiple VMs or instances, not to provide administrative connectivity into an individual VM's operating system. Moreover, it requires target VMs to have healthy endpoints and does not offer any authentication, session establishment, or browser-based RDP/SSH gateway functionality, so it cannot be used to manage Linux VMs interactively.

  When this WOULD be correct

  A question asking for distributing inbound traffic across multiple virtual machines for high availability or scaling, without requiring direct VM management from a browser.

• ✗

  Private endpoint

  Why it's wrong here

  A private endpoint is a network interface with a private IP address from an Azure VNet that is used to connect securely to Azure Platform-as-a-Service resources (such as Storage, SQL Database, or Cosmos DB) or to your own service via Azure Private Link. It effectively brings the service into the VNet, but it is a connectivity mechanism for the service's data plane, not a desktop or SSH management tool. Since a private endpoint does not expose any RDP/SSH protocol, provide authentication, or render a browser-based session, it cannot be used to manage virtual machines interactively.

  When this WOULD be correct

  A question asks: 'You need to securely connect to an Azure Storage account from a virtual network without using a public endpoint. Which Azure service should you use?' In that context, Private endpoint would be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question