AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure Bastion

  Why this is correct

  Azure Bastion is the correct choice because it is a platform-managed PaaS service that provides secure, browser-based RDP and SSH access to Azure VMs directly from the Azure portal. It connects to a VM's private IP over TLS without requiring a public IP, an agent, or a VPN client on the user's workstation. The service also integrates with Microsoft Entra ID for additional authentication and even supports conditional access policies, making it the ideal secure remote access tool for this scenario.

• ✗

  Azure VPN Gateway

  Why it's wrong here

  Azure VPN Gateway is not correct for this scenario because it is primarily a network connectivity service that creates site-to-site or point-to-site IPsec tunnels. While a point-to-site VPN would allow an administrator to reach the VNet, it still requires installing and configuring a VPN client on the administrator's workstation and does not provide browser-based RDP/SSH connectivity. The gateway only encapsulates network packets, leaving remote desktop or SSH session handling to separate client software, so it does not satisfy the stated security requirement.

  When this WOULD be correct

  A company needs to connect its on-premises network to Azure VNets securely over the internet, using IPsec tunnels, and administrators are allowed to install VPN client software on their local workstations.

• ✗

  Azure Firewall

  Why it's wrong here

  Azure Firewall is incorrect because it is a stateful, managed network security service that filters and logs traffic at the network edge, not a remote connectivity tool. It can inspect and block traffic destined for VMs, but it does not masquerade as a jump host or support native RDP/SSH session initiation from a browser. Using Azure Firewall would not remove the need for a public IP or a VPN client for secure VM access; it only enforces north-south and east-west security rules, so it cannot replace the functionality of Azure Bastion.

  When this WOULD be correct

  A company needs to centrally control and log outbound/inbound traffic to and from Azure VMs, with requirements for threat intelligence-based filtering and high availability. Azure Firewall would be the correct service to deploy as a perimeter firewall.

• ✗

  Azure ExpressRoute

  Why it's wrong here

  Azure ExpressRoute is wrong because it is a dedicated, private WAN connection from an on-premises network to Azure, established through an MPLS or similar carrier provider. It extends the corporate network into Azure at Layer 2/Layer 3 but offers no interactive remote access functionality, so an administrator would still need to deploy a separate remote desktop or SSH solution. Additionally, ExpressRoute is meant for consistent low-latency bandwidth and requires additional configuration like a virtual network gateway, making it unsuitable as a direct jump-server alternative for browser-based access.

  When this WOULD be correct

  A company needs a private, high-bandwidth, low-latency connection between their on-premises data center and Azure, with no traffic traversing the internet, and they require a service-level agreement for availability. ExpressRoute would be the correct choice.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question