AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure Bastion

  Why this is correct

  Azure Bastion is a fully managed PaaS service deployed inside an Azure virtual network; it brokers RDP and SSH sessions from the Azure portal over TLS/443 to a VM using only its private IP address. Because the VM never receives a public IP and Bastion establishes the connection from its own subnet, the management ports stay hidden from the internet. It supports Microsoft Entra ID credential validation, clipboard file transfer, and can be secured with RBAC roles and NSGs on the Bastion subnet.

• ✗

  Azure VPN Gateway

  Why it's wrong here

  An Azure VPN Gateway creates an encrypted IPsec tunnel between an on-premises site or remote user and the Azure VNet, but it still requires a gateway public IP and a compatible VPN client/device; it does not render the VM accessible in a browser. After the tunnel is established, you would still need an RDP/SSH client and a routable path to the VM's private IP, and the gateway itself remains a network-level endpoint rather than a session broker. The scenario asks for direct, browser-based VM administration without a public IP, which VPN Gateway cannot provide by itself.

  When this WOULD be correct

  A question requiring secure connectivity from an on-premises network to an Azure VNet, such as 'You need to connect your on-premises network to Azure VNet over the internet with encrypted traffic. Which service should you use?'

• ✗

  Public IP address on the VM

  Why it's wrong here

  Assigning a public IP address to the VM's NIC makes the RDP or SSH port directly reachable from the internet unless an NSG explicitly blocks it, and the requirement specifically eliminates any public endpoint. Even with NSG source restrictions, the very existence of a routable public address contradicts the 'no public IP' constraint and exposes the host to port scanning and brute-force attempts. Azure Bastion is the answer only because it eliminates this surface by keeping the VM on a private IP.

  When this WOULD be correct

  A question that asks for the simplest way to enable direct RDP or SSH access from the internet to a VM, with no requirement to avoid public IPs or provide browser-based access. For example: 'Which resource must be associated with a VM to allow direct RDP connections from the internet?'

• ✗

  Azure Load Balancer

  Why it's wrong here

  Azure Load Balancer is a layer-4 forwarding device that distributes inbound TCP/UDP flows across backend pool members based on rules and health probes; it cannot terminate, authenticate, or generate RDP/SSH console sessions. Adding it would still require the VM to expose its management port on a private or public listener, and the load balancer would merely pass the connection through to whichever VM the rule selects. Its purpose is scaling north-south traffic, not providing secure administrative access, so it does not replace the isolation that Bastion gives.

  When this WOULD be correct

  You need to distribute incoming web traffic across multiple VMs in a backend pool to ensure high availability and scalability for a web application. The VMs are in a virtual network, and you want to expose them via a single public endpoint.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question