AZ-500 Secure networking Practice Question
You need to provide secure remote access to Azure virtual machines without assigning them public IP addresses. Which Azure service should you use?
⚠ Common exam trap
Test-takers frequently confuse Azure Bastion with Azure VPN Gateway, assuming a VPN is required for secure remote access, but Bastion is the correct choice when the goal is to avoid any public IP assignment and provide direct portal-based RDP/SSH.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Bastion
Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure virtual machines directly in the Azure portal over TLS, without exposing public IP addresses. It uses a hardened, fully managed platform as a service (PaaS) that sits inside your virtual network, eliminating the need for a jump box or public-facing endpoints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway establishes encrypted site-to-site (IPsec/IKE) or point-to-site (SSTP/IKEv2/OpenVPN) tunnels to connect remote networks or clients to an Azure VNet. While those tunnels protect traffic in transit, they do not provide a browser-based RDP/SSH session directly to a VM; you would still need a jump host or a VM with a public IP to start a session. Therefore, VPN Gateway addresses network-level connectivity, not the specific requirement of secure, portal-accessible remote access to the VM.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a stateful, platform-managed security service that allows or denies north-south and east-west traffic based on network and application rules, such as FQDN filtering and NAT. It operates at the packet and connection level and cannot broker interactive RDP/SSH sessions; it merely controls whether traffic is permitted or blocked. This makes it a complementary security control for remote access, but not a remote-access service itself, so it fails the stated requirement.
- ✓
Azure Bastion
Why this is correct
Azure Bastion is a fully managed PaaS jump host deployed into a VNet that provides secure RDP and SSH connectivity to Azure VMs over TLS on port 443, directly within the Azure portal. It eliminates the need for each VM to have a public IP address or any inbound NSG rules for RDP/SSH, and it uses Microsoft Entra ID credentials, allowing integration with conditional access and multi-factor authentication. The broker service manages the session, making Azure Bastion the correct service for providing secure remote access to Azure virtual machines.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global layer-7 load balancer and content delivery network that routes HTTP/HTTPS traffic, optimizes web application performance, and provides edge security such as WAF and SSL offload. Its protocol scope is limited to HTTP, HTTPS, and WebSockets, so it has no native capability to proxy RDP/SSH sessions or present a VM console to an administrator. It is built for application delivery and acceleration, not for granting interactive administrative access to individual Azure VMs, making it the wrong choice for this requirement.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.