AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure VPN Gateway

  Why it's wrong here

  Azure VPN Gateway is incorrect in this context because it provides network-level encrypted tunnels (Site-to-Site or Point-to-Site) between on-premises networks or individual clients and a virtual network. It allows VMs to be reached via their private IP addresses, but this requires a VPN client configuration and does not offer a browser-based RDP/SSH service over TLS. The gateway itself has a public IP and acts as a network connectivity device, whereas Bastion is specifically designed for secure management access without exposing VM network interfaces or requiring VPN setup.

• ✓

  Azure Bastion

  Why this is correct

  Azure Bastion is the correct answer because it is a fully managed PaaS service that provides secure, browser-based RDP and SSH connectivity to Azure VMs directly from the Azure portal. It is deployed into a virtual network and allows VM access over TLS without requiring any public IP address to be assigned to the VM itself. Additionally, Bastion protects against port scanning and allows organizations to enforce Azure AD conditional access policies, making it the ideal solution for secure VM administration.

• ✗

  Azure Private Link

  Why it's wrong here

  Azure Private Link is incorrect for this scenario because its purpose is to establish private network access from a virtual network to Azure PaaS services (such as Azure Storage or SQL Database) or to your own custom services using private endpoints. It provides data-plane connectivity to those services over private IP addresses, but it does not offer the browser-based RDP/SSH session capability required for VM management. The question specifically asks for a service to eliminate public IPs on VMs for remote administration, which is Bastion's function, not Private Link's.

• ✗

  Azure Active Directory Application Proxy

  Why it's wrong here

  Azure Active Directory Application Proxy is incorrect because it is a reverse proxy designed to publish on-premises web applications to external users through the Azure AD authentication layer. It supports HTTP and HTTPS traffic for web apps and uses connectors on the on-premises network; it does not natively handle RDP or SSH protocols for Azure VMs. While it can provide remote access through a web portal, it is not the service that provides browser-based RDP/SSH to VMs without public IPs.

Go deeper

Related to this question