Match each Azure VM access feature to the task it supports.
Drag a concept onto its matching description — or click a concept then click the description.
Runs a script on a VM without opening inbound management ports.
Installs software or applies configuration during VM provisioning.
Lets users sign in to a VM with Entra identities.
Resets local administrator credentials or SSH configuration on a VM.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Azure Bastion: Provides secure RDP/SSH to VMs without public IP
Azure Bastion provides secure RDP/SSH without public IP; JIT restricts port access; NSGs filter traffic; Azure AD authentication enables identity-based login; Private Link ensures private connectivity; Firewall offers centralized control.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Azure Bastion: Provides secure RDP/SSH to VMs without public IP
Why this is correct
Azure Bastion is a fully managed PaaS service that provides secure, seamless RDP and SSH access to Azure VMs directly in the Azure portal over TLS, without assigning public IP addresses to the VMs. It is deployed into a VNet with a dedicated AzureBastionSubnet and uses NSG rules to control inbound traffic, preventing VMs from being exposed to the internet while still allowing administrative connectivity. This is the correct match because it specifically eliminates public IP exposure while delivering remote access.
JIT VM Access: Restricts port access to VMs by allowing only when needed
Why this is correct
Just-in-Time (JIT) VM access, a feature of Microsoft Defender for Cloud, reduces attack surface by locking inbound traffic to VMs via deny-all NSG rules for common management ports (such as RDP 3389 and SSH 22). When a user requests access, if the request is approved and the user has permission, a time-limited allow rule is dynamically created for the user's IP address, then automatically revoked after the session ends. This matches the task of restricting port access to VMs, allowing only the specific ports required at the time of a legitimate need.
NSG: Filters network traffic to and from Azure resources
Why this is correct
Network Security Groups (NSGs) act as a distributed, stateful filtering firewall for Azure resources, controlling network traffic to and from VMs by serving as a virtual firewall at the subnet or network interface level. They contain inbound and outbound security rules that permit or deny traffic based on source/destination IP, port, and protocol, and are evaluated in priority order. This directly aligns with filtering network traffic to and from Azure resources, providing baseline segmentation and security controls within a virtual network design.
Azure AD authentication: Provides secure RDP/SSH without public IP
Why it's wrong here
Azure AD authentication provides identity-based login to Azure VMs using your organization's Azure AD credentials, enabling capabilities such as MFA, conditional access, and privileged identity management. However, it does not remove the need for a public IP or a direct network path to the VM—it only controls who can sign in once network connectivity is available. This option is incorrect because the described outcome of 'secure RDP/SSH without public IP' is exactly what Azure Bastion delivers, not Azure AD authentication.
Private Link: Manages firewall rules centrally
Why it's wrong here
Private Link provides secure, private connectivity to Azure platform services (like Storage or SQL Database) by mapping the service to a private endpoint in a virtual network, keeping traffic on the Microsoft backbone and away from the public internet. It does not possess any capability to centrally manage firewall rules, as that is the job of Azure Firewall with its rule collections, NAT rules, and policy. This mislabeling makes the option wrong—Private Link is about reaching PaaS services privately, not about firewall rule administration.
Go deeper
Learn chapter
Privileged Identity Management (PIM)
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Private Link
Private Link is a technology that lets you connect your virtual network to a service over a private, secure connection inside the cloud provider's infrastructure, instead of going over the public internet.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.