AZ-900 Describe Azure architecture and services Practice Question
A company has deployed several Windows and Linux virtual machines in an Azure virtual network. For security reasons, the virtual machines have no public IP addresses assigned. The IT administrators need to securely connect to these VMs using Remote Desktop Protocol (RDP) for Windows and Secure Shell (SSH) for Linux without deploying any additional agents on the VMs. The connection must be established directly from the Azure portal, and the service must provide protection against port scanning and brute-force attacks. Which Azure service should the company use?
⚠ Common exam trap
Watch out — candidates often confuse Just-in-time VM access with Bastion, but JIT still requires public IP exposure and does not provide a portal-based connection, whereas Bastion eliminates public endpoints entirely and offers native portal access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Bastion
Azure Bastion is the correct choice because it provides secure, seamless RDP and SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring any public IP addresses on the VMs or additional agent installations. It uses a hardened bastion host inside the virtual network, and by default it protects against port scanning and brute-force attacks by not exposing the VMs' RDP/SSH ports to the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Just-in-time (JIT) VM access (Microsoft Defender for Cloud)
Why it's wrong here
Just-in-time VM access reduces the attack surface by temporarily opening ports to specific IP addresses, but it requires the VMs to have public IP addresses and does not provide a direct RDP/SSH session from the Azure portal without a public IP.
When this WOULD be correct
A company has VMs with public IP addresses and wants to minimize exposure to brute-force attacks by allowing RDP/SSH access only during authorized time windows. The IT team can use JIT to request temporary port openings via the Azure portal or API.
- ✓
Azure Bastion
Why this is correct
Azure Bastion is a fully managed PaaS service that provides secure RDP and SSH access to virtual machines directly from the Azure portal. It uses SSL and is deployed inside the virtual network, so VMs do not need public IPs, and the service protects against port scanning and brute-force attacks.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a stateful, managed network security service that filters and logs both inbound and outbound traffic across Azure Virtual Network resources based on application and network rules. It operates at the network layer to block or allow connections, but it does not offer a portal-based remote desktop or SSH session. While it can be used to restrict which sources can attempt to reach a VM, it cannot terminate RDP/SSH protocols or provide the browser-embedded connectivity that Azure Bastion delivers.
When this WOULD be correct
A company needs to centrally control and log outbound/inbound traffic to and from Azure virtual networks, enforce application rules, and filter traffic based on FQDN. Azure Firewall would be correct for a scenario requiring network-level security policies and threat intelligence-based filtering.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway is used to create site-to-site or point-to-site VPN connections to an Azure virtual network. While administrators can connect to a VNet via VPN and then RDP/SSH to VMs, this requires the VMs to have private IPs accessible after VPN connection. It does not provide a direct portal-based RDP/SSH session with built-in protection against port scanning, and it typically involves additional configuration and client software.
When this WOULD be correct
A company needs to securely connect an on-premises network to an Azure virtual network to allow on-premises users to access Azure VMs via private IP addresses, using site-to-site VPN or point-to-site VPN connections.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BastionCorrect answer▾
Why this is correct
Azure Bastion is a fully managed PaaS service that provides secure RDP and SSH access to virtual machines directly from the Azure portal. It uses SSL and is deployed inside the virtual network, so VMs do not need public IPs, and the service protects against port scanning and brute-force attacks.
✗Just-in-time (JIT) VM access (Microsoft Defender for Cloud)Wrong answer — click to see why▾
Why this is wrong here
JIT VM access reduces the attack surface by opening ports only when needed, but it still requires the VMs to have public IP addresses or a jump box with public access. The question specifies VMs have no public IPs and requires direct portal connection without agents, which JIT cannot fulfill.
★ When this WOULD be the correct answer
A company has VMs with public IP addresses and wants to minimize exposure to brute-force attacks by allowing RDP/SSH access only during authorized time windows. The IT team can use JIT to request temporary port openings via the Azure portal or API.
Why candidates choose this
Candidates may confuse JIT's security benefits (reducing attack surface) with the requirement for secure remote access, overlooking that JIT does not eliminate the need for public endpoints or provide a direct portal-based connection without agents.
✗Azure FirewallWrong answer — click to see why▾
Why this is wrong here
Azure Firewall is a network security service that filters traffic between subnets, but it does not provide direct RDP/SSH connectivity from the Azure portal without public IPs or agents. It cannot replace the need for a jump server or Bastion for secure portal-based connections.
★ When this WOULD be the correct answer
A company needs to centrally control and log outbound/inbound traffic to and from Azure virtual networks, enforce application rules, and filter traffic based on FQDN. Azure Firewall would be correct for a scenario requiring network-level security policies and threat intelligence-based filtering.
Why candidates choose this
Candidates may think Azure Firewall can secure RDP/SSH by filtering traffic, but they overlook that it does not provide the actual connectivity mechanism (like Bastion) for VMs without public IPs. The focus on 'protection against port scanning' misleads them into choosing a firewall service.
✗Azure VPN GatewayWrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway provides encrypted site-to-site or point-to-site connectivity, but it does not offer direct RDP/SSH access from the Azure portal without public IPs on VMs, nor does it include built-in protection against port scanning and brute-force attacks.
★ When this WOULD be the correct answer
A company needs to securely connect an on-premises network to an Azure virtual network to allow on-premises users to access Azure VMs via private IP addresses, using site-to-site VPN or point-to-site VPN connections.
Why candidates choose this
Candidates may think VPN Gateway provides secure remote access to VMs, but they overlook the requirement for portal-based access and the specific security features (port scanning/brute-force protection) that Azure Bastion offers.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure portal
The Azure portal is a web-based, unified console that lets you build, manage, and monitor everything from simple web apps to complex cloud deployments using a graphical user interface.
Key term
Azure Virtual Network
Azure Virtual Network is a cloud service that lets you create a private, isolated network in the Microsoft Azure cloud, allowing your virtual machines and other resources to communicate securely with each other, the internet, and your on-premises network.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.