AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure VPN Gateway Point-to-Site

  Why it's wrong here

  Azure VPN Gateway Point-to-Site is incorrect for this scenario because it requires each user to install and configure a VPN client on their device to establish an IPsec tunnel to the virtual network. Even with the tunnel in place, connecting to a VM's RDP or SSH service still requires reaching the VM's IP address, which typically means the VM must have a public IP or a route through a load balancer. This approach does not provide browser-based access to the VM console and leaves VM management ports exposed to the network if not further secured by NSGs. Azure Bastion, in contrast, is a fully managed PaaS service that gives users direct browser-based RDP/SSH sessions over SSL, with no VM public IP or client software required.

• ✓

  Azure Bastion

  Why this is correct

  Azure Bastion is the correct choice because it provides secure, seamless browser-based RDP and SSH connectivity to Azure VMs directly from the Azure portal over TLS. It eliminates the need for VMs to have public IP addresses and removes the requirement to open inbound RDP or SSH ports on the VM's network security group, which significantly reduces the attack surface. Bastion integrates with Azure Active Directory and MFA, and it supports both Windows and Linux VMs, making it ideal for secure administrative access. It is a PaaS service that is deployed inside the virtual network, ensuring that all traffic stays within the Azure backbone.

• ✗

  Azure AD Application Proxy

  Why it's wrong here

  Azure AD Application Proxy is wrong for this scenario because its purpose is to provide remote access to on-premises web applications through an outbound connector, not to give browser-based access to Azure VM desktops. It publishes HTTP and HTTPS endpoints for web apps and does not natively support RDP or SSH protocol forwarding to VMs. Application Proxy also requires the application to be registered in Azure AD and is designed for identity-aware access to line-of-business apps, not for managing virtual machine operating systems. Azure Bastion, by contrast, is the correct service for secure browser-based VM administration.

• ✗

  Azure Firewall Just-In-Time access

  Why it's wrong here

  Azure Firewall Just-In-Time (JIT) access is not the right answer because JIT is actually a feature of Microsoft Defender for Cloud, not Azure Firewall, and it focuses on temporarily opening specific inbound ports (like RDP or SSH) to allow authorized users to connect. While it reduces exposure by limiting port open times, the user still needs an RDP or SSH client and a public IP on the VM to connect after the port is opened. JIT does not provide a browser-based console and does not eliminate the need for open ports entirely, unlike Azure Bastion which avoids any inbound management ports. Furthermore, JIT is a security control for reducing attack surface, not a connectivity service for seamless browser access.

Go deeper

Related to this question