Third-party support engineers connect from the public internet and need browser-based RDP and SSH access to Azure VMs that have only private IPs. The security team will not allow public IPs on the VMs, inbound 3389 or 22 from the internet, or a client VPN on each laptop. What should you deploy?

VPN Gateway with point-to-site configuration

A VPN would require client configuration on each laptop, which the requirement explicitly rejects.

A public load balancer with inbound NAT rules

That would expose management ports to the internet, which the security team does not allow.

A NAT gateway attached to the VM subnet

A NAT gateway supports outbound internet access only and does not provide inbound administrative access.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Azure Bastion — Azure Bastion is designed for secure administrative access to VMs without assigning public IP addresses to the VMs themselves. It enables RDP and SSH over the Azure portal or browser-based workflow, so support staff can connect from the internet without installing a VPN client or opening inbound management ports. This directly matches the requirement for private-only VMs and browser-based access. Why others are wrong: VPN Gateway would satisfy private access, but it conflicts with the no-client-VPN requirement. A public load balancer or NAT rules would expose management services on public addresses, which is not allowed. A NAT gateway only handles outbound connectivity and cannot initiate inbound administrative sessions. Bastion is the only option that fits all constraints.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.