AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure Bastion

  Why this is correct

  Correct. Azure Bastion is a fully managed PaaS service that provides secure, browser-based RDP and SSH connectivity to Azure virtual machines directly from the Azure portal, over TLS. Because it is deployed inside the virtual network, VMs need no public IP addresses, no client software, and no VPN or ExpressRoute connection. Traffic is mediated by the Bastion instance, and you can enforce Azure RBAC and MFA on top of this access, making it the intended tool for securely administering internal VMs.

• ✗

  Azure Front Door

  Why it's wrong here

  Azure Front Door is a global application delivery and load-balancing service that routes HTTP/HTTPS traffic across Azure regions for web applications, offering CDN acceleration, global failover, and WAF. It operates at the layer-7 edge and does not support generic TCP protocols such as RDP or SSH. As a result, it cannot establish a remote management session to an individual VM, making it an incorrect choice for secure VM administrative access.

  When this WOULD be correct

  A company needs to accelerate and secure global web application delivery with SSL termination, web application firewall, and URL-based routing across multiple Azure regions. Azure Front Door would be the correct choice for this scenario.

• ✗

  Azure Application Gateway

  Why it's wrong here

  Azure Application Gateway is a regional layer-7 (HTTP/HTTPS) load balancer with features like URL-based routing, SSL termination, and Web Application Firewall. It is designed for distributing inbound web traffic across a pool of backend web servers, not for brokering RDP or SSH sessions. It cannot forward arbitrary TCP/UDP ports or provide an interactive remote desktop terminal, so it is not a substitute for secure VM administrative access.

  When this WOULD be correct

  A company needs to load balance HTTP/HTTPS traffic across multiple Azure VMs in a web farm, with SSL termination, URL-based routing, and WAF protection to secure against common web vulnerabilities.

• ✗

  Azure Virtual Network NAT

  Why it's wrong here

  Azure Virtual Network NAT is a managed network address translation service that provides outbound-only internet connectivity for VMs in a subnet, mapping private source IPs to a public IP for egress. It explicitly does not allow inbound connections, so it cannot accept incoming RDP or SSH traffic. While it is useful for outbound callbacks, it offers no path for remote administration of critical internal VMs, and its use would not replace the need for a secure inbound access gateway.

  When this WOULD be correct

  A company needs to enable outbound internet access for VMs in a virtual network without assigning public IPs to each VM, while maintaining a predictable source IP address for external connections.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question