AZ-900 Describe Azure architecture and services Practice Question
A company runs several Azure virtual machines (VMs) in a virtual network. Administrators need to connect to these VMs using Remote Desktop Protocol (RDP) to perform maintenance tasks. The security team mandates that the VMs must not have any public IP addresses assigned. All RDP traffic must be routed through a fully managed Azure service that provides secure TLS-based access directly from the Azure portal, without requiring any client software installation on the administrator's workstation. Which Azure service should the company use?
⚠ Common exam trap
Watch out — candidates often confuse Azure Bastion with Azure VPN Gateway, assuming any 'secure tunnel' service can replace the need for public IPs, but VPN Gateway still requires client software and does not provide portal-based RDP access without public endpoints.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Bastion
Azure Bastion is a fully managed Platform as a Service (PaaS) that provides secure and seamless RDP/SSH connectivity to virtual machines directly from the Azure portal over TLS. It eliminates the need for public IP addresses on the VMs by deploying a Bastion host in the same virtual network, acting as a jump server that brokers the connection. Because it requires no client software on the administrator's workstation and enforces TLS-based access, it perfectly meets the security mandate and connectivity requirements described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Bastion
Why this is correct
Azure Bastion is correct because it provides secure, TLS-encrypted RDP/SSH access to Azure VMs directly from the Azure portal without requiring public IPs on the VMs or any client software, meeting all of the company's requirements.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway is used to create encrypted cross-premises or site-to-site connections over the public internet. It requires the VPN gateway to have a public IP, and typically a VPN client (such as the Azure VPN Client or a third-party client) must be installed on the administrator's device, which does not meet the 'no client software' requirement.
When this WOULD be correct
A company needs to connect on-premises networks to Azure VMs over the internet using encrypted tunnels, and administrators are willing to install VPN client software on their workstations.
- ✗
Azure ExpressRoute
Why it's wrong here
Azure ExpressRoute extends on-premises networks into Azure over a dedicated private connection. It does not provide direct RDP connectivity to VMs via the portal and requires on-premises network hardware and a connectivity provider, not a pure portal-based access solution.
When this WOULD be correct
A company needs a dedicated, private, and high-bandwidth connection between on-premises and Azure, bypassing the internet for compliance or performance reasons, without requiring RDP access from the portal.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a web traffic load balancer that operates at Layer 7 (HTTP/HTTPS). While it can provide secure access for web applications, it is not designed for RDP/SSH connections and does not offer the direct, portal-based VM access that the scenario describes.
When this WOULD be correct
A company needs to load balance HTTP/HTTPS traffic to web servers in a virtual network, with SSL termination and web application firewall (WAF) capabilities to protect against common web exploits.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BastionCorrect answer▾
Why this is correct
Azure Bastion is correct because it provides secure, TLS-encrypted RDP/SSH access to Azure VMs directly from the Azure portal without requiring public IPs on the VMs or any client software, meeting all of the company's requirements.
✗Azure VPN GatewayWrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway requires client software installation on the administrator's workstation and does not provide direct RDP access from the Azure portal without public IP addresses.
★ When this WOULD be the correct answer
A company needs to connect on-premises networks to Azure VMs over the internet using encrypted tunnels, and administrators are willing to install VPN client software on their workstations.
Why candidates choose this
Candidates may confuse VPN Gateway with Bastion because both provide secure remote access, but VPN Gateway is for site-to-site or point-to-site connectivity, not for direct RDP/SSH from the portal without public IPs.
✗Azure ExpressRouteWrong answer — click to see why▾
Why this is wrong here
Azure ExpressRoute extends on-premises networks into Azure over a private connection, not via the internet, and does not provide TLS-based RDP access from the Azure portal without public IPs.
★ When this WOULD be the correct answer
A company needs a dedicated, private, and high-bandwidth connection between on-premises and Azure, bypassing the internet for compliance or performance reasons, without requiring RDP access from the portal.
Why candidates choose this
Candidates may confuse ExpressRoute as a secure connectivity option for RDP, not realizing it is a private WAN link, not a service for direct VM access from the portal.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway is a layer 7 load balancer and web application firewall, not a service for secure RDP access to VMs without public IPs. It does not provide TLS-based RDP connectivity directly from the Azure portal.
★ When this WOULD be the correct answer
A company needs to load balance HTTP/HTTPS traffic to web servers in a virtual network, with SSL termination and web application firewall (WAF) capabilities to protect against common web exploits.
Why candidates choose this
Candidates may confuse the TLS-based secure access feature of Application Gateway with the secure RDP access provided by Azure Bastion, or think that Application Gateway can handle any TLS traffic including RDP.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Azure portal
The Azure portal is a web-based, unified console that lets you build, manage, and monitor everything from simple web apps to complex cloud deployments using a graphical user interface.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.