AZ-500 Secure networking Practice Question
A company has several Azure virtual machines (VMs) in a VNet that host a legacy application. IT support staff need to perform remote administration using RDP. The security team wants to avoid exposing the VMs to the public internet and also enforce Azure Multi-Factor Authentication (MFA) for all RDP sessions. Which Azure service should they deploy to meet these requirements?
⚠ Common exam trap
Test-takers frequently confuse Just-in-Time (JIT) VM Access with MFA enforcement, but JIT only controls network-level access timing and does not natively enforce Azure MFA for the RDP session itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Bastion
Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure VMs directly from the Azure portal over TLS, without exposing the VMs to a public IP address. It also integrates with Azure AD and Conditional Access to enforce Azure Multi-Factor Authentication (MFA) for all RDP sessions, meeting both the security and compliance requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Just-in-Time (JIT) VM Access from Microsoft Defender for Cloud
Why it's wrong here
JIT VM Access from Microsoft Defender for Cloud reduces attack surface by opening the RDP/SSH port only during an approved access window, but it does not eliminate the need for the VM to have a public IP address or a public-facing load balancer — the connection still reaches the VM directly via that public endpoint. More importantly, JIT itself does not enforce Azure AD MFA; while you can optionally require MFA through your identity provider during the JIT approval process, this requires extra configuration and is not a native capability of JIT. Therefore, JIT alone fails both requirements of eliminating public exposure and enforcing MFA.
- ✓
Azure Bastion
Why this is correct
Azure Bastion is correct because it provides RDP/SSH access directly in the Azure portal over TLS, so the VM never gets a public IP address and is never directly exposed to the internet. Since Bastion authenticates the user through Azure AD before launching the session, it natively integrates with Conditional Access, allowing you to enforce MFA as a prerequisite for any remote connection. This fulfills both stated requirements: no public IP exposure and mandatory MFA.
- ✗
Network Security Groups (NSGs) with allow rules for RDP only from a trusted IP
Why it's wrong here
Network Security Groups (NSGs) are not a remote-access solution — they only filter traffic at the subnet or NIC layer, and they cannot inherently grant MFA. Even if you create an NSG rule that allows RDP only from a specific trusted public IP, the VM must still have a public IP (or be reachable via a public load balancer/firewall) for that rule to have any effect from the internet. NSGs have no identity awareness, so they have no way to require a second factor or validate an Azure AD token, making this option technically insufficient.
- ✗
Azure Firewall with DNAT rules to forward RDP traffic
Why it's wrong here
Azure Firewall has no native MFA capability — it is a network security service that filters traffic based on rules, not an identity gateway. Using DNAT rules to forward RDP from the firewall's public IP to the VM's private IP simply shifts the exposure to the firewall's public address and does not require the user to authenticate with MFA before the session is established. You would need to add a second component (such as Azure AD Application Proxy or a VPN gateway with Azure AD authentication) to enforce MFA, so this option is incomplete for the stated requirements.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.