AZ-500 Secure networking Practice Question
You configure Azure Bastion to allow secure RDP access to VMs in a VNet. However, users report that they cannot connect to a specific VM, while other VMs in the same VNet are accessible. The VM is running and has a public IP. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often assume a public IP on the VM is the problem, but Azure Bastion explicitly bypasses public IPs and uses private IPs, so the public IP is irrelevant; the real issue is the NSG rule blocking inbound traffic from the AzureBastionSubnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NSG on the VM's subnet does not allow inbound RDP from the AzureBastionSubnet.
Azure Bastion provides secure RDP/SSH connectivity to VMs in a peered VNet without exposing public IPs. For Bastion to reach a VM, the Network Security Group (NSG) on the VM's subnet must allow inbound TCP traffic on port 3389 from the AzureBastionSubnet (which uses the Azure Bastion service's private IP range). If the NSG blocks this traffic, Bastion cannot establish the RDP session even though the VM is running and has a public IP. The correct answer is B because the NSG misconfiguration is the most likely cause when other VMs in the same VNet are accessible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user does not have 'Reader' role on the VM.
Why it's wrong here
The Reader role on a target VM is required for Azure Bastion to enumerate the VM and retrieve its network interface details when you browse the virtual machines in the portal. However, the actual RDP connection is established over the Bastion host and is governed by network path and RBAC on the Bastion resource, not by whether the user can list the VM. Since the scenario states other VMs are accessible, the user's role assignments are already sufficient, so a missing Reader role would prevent the VM from appearing at all—not cause a single failed connection.
- ✓
The NSG on the VM's subnet does not allow inbound RDP from the AzureBastionSubnet.
Why this is correct
Azure Bastion injects the Bastion host into the AzureBastionSubnet, and for RDP to reach a target VM, the NSG attached to the VM's subnet must include an inbound allow rule for TCP 3389 from the address prefix of the AzureBastionSubnet. Without that rule, packets from the Bastion host are silently dropped by the target subnet's network security group, so the connection fails even if the rest of the configuration is correct. This is a common misconfiguration because users often open RDP only from the internet or their local IP, not from the Bastion subnet's private address range.
- ✗
The VM is located in a different region than the Bastion host.
Why it's wrong here
A VM in a different region than the Bastion host cannot exist in the same virtual network, since every VNet is scoped to a single Azure region. Bastion only connects to VMs that reside in the same VNet as the Bastion host itself; if the VM were truly in another region, it would not be listed as a connectable target in the Bastion pane. Therefore, a region mismatch between the VM and the Bastion host is not the cause of a failed RDP attempt to a VM that is otherwise visible and accessible.
- ✗
The VM has a public IP assigned, which interferes with Bastion connectivity.
Why it's wrong here
The presence of a public IP address on a target VM does not interfere with Azure Bastion's connectivity path—Bastion connects to the VM's private IP address through the Azure network backbone, and the VM can have a public IP or be entirely private. In fact, Bastion exists precisely to eliminate the need for public IP exposure; a public IP would only matter if you were trying to RDP directly over the internet. Since the connection is always proxied via the Bastion host, the VM's public IP has no effect on the success or failure of the Bastion RDP session.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.