AZ-104 Deploy and Manage Azure Compute Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Load Balancer

  Why it's wrong here

  Azure Load Balancer operates at Layer 4 and distributes TCP/UDP traffic to healthy back-end VM instances based on load-balancing rules. While it could forward RDP/SSH traffic to a VM's private IP, it only passes the connection through — it does not authenticate users, restrict source IPs, or render the underlying OS session in a secured browser context. Exposing management ports through a public load balancer frontend would also expand the attack surface, making it unsuitable for controlled administrative access compared to Bastion.

  When this WOULD be correct

  When the question asks for distributing incoming traffic across multiple VMs to ensure high availability and scalability, and the VMs have public IPs or are accessible via other means, Azure Load Balancer would be the correct answer.

• ✓

  Azure Bastion

  Why this is correct

  Azure Bastion provides secure browser-based RDP and SSH access to VMs in a virtual network without needing public IP addresses on the VMs. It also avoids exposing management ports directly to the internet and does not require the user to install a VPN client. This makes it a strong fit for controlled administrative access in locked-down environments.

• ✗

  VPN Gateway point-to-site only

  Why it's wrong here

  A point-to-site VPN Gateway creates an encrypted IPsec/IKE tunnel from an individual client machine to an Azure virtual network, requiring a VPN client and an authentication mechanism such as certificates or Azure AD. It does not provide browser-based, portal-native RDP or SSH console access to VMs, and it does not eliminate the need for the VM to be reachable and have the appropriate ports open internally. Even when a client is connected to the VNet, the user must launch a separate RDP/SSH client to reach the VM, so this is a network-level connectivity service rather than a centralized management access tool.

  When this WOULD be correct

  A question where users need secure remote access from remote locations without public IPs on VMs, but are allowed to install a VPN client on their devices, and the requirement is to avoid exposing RDP/SSH to the internet.

• ✗

  Application Gateway

  Why it's wrong here

  Azure Application Gateway is an HTTP/HTTPS Layer-7 load balancer designed to route web traffic based on URL paths or host headers, with features like TLS termination and Web Application Firewall. It does not natively proxy non-HTTP protocols such as RDP (port 3389) or SSH (port 22), nor does it offer interactive console or browser-based sessions to a VM's operating system. As a result, it cannot be used for administrative access even though it sits in front of a VNet's resources.

  When this WOULD be correct

  When the requirement is to expose web applications to the internet with SSL termination, URL-based routing, and Web Application Firewall (WAF) protection, and the VMs have private IPs behind the gateway.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question