AZ-900 Describe Azure architecture and services Practice Question
A company has deployed several Azure virtual machines in a virtual network. The security policy requires that administrators must be able to connect to these VMs using Remote Desktop Protocol (RDP) from the Azure portal, but the VMs must not have any public IP addresses assigned. The company wants to minimize management overhead and avoid deploying additional jump-box virtual machines. Which Azure service should they use?
⚠ Common exam trap
Candidates often confuse Azure Bastion with a VPN gateway, assuming any remote access requires a VPN tunnel, but Azure Bastion provides a simpler, browser-based solution without the complexity of VPN configuration or public IPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Bastion
Azure Bastion provides secure and seamless RDP/SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring public IP addresses on the VMs. It is a fully managed PaaS service that is deployed inside the virtual network, eliminating the need for a jump-box or additional management overhead. This meets the security policy by ensuring VMs remain isolated from the internet while administrators can still connect via the portal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Bastion
Why this is correct
Azure Bastion is a fully managed PaaS service that provides secure RDP and SSH access to Azure virtual machines directly from the Azure portal, without exposing the VMs via public IP addresses. It eliminates the need for a separate jump-box VM and reduces management overhead, making it the correct choice for this scenario.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global content delivery network and application load balancer designed to optimize web traffic and provide web application firewall capabilities. It does not provide RDP or SSH connectivity to individual virtual machines.
When this WOULD be correct
A company wants to improve the performance and availability of a global web application by routing user traffic to the nearest backend endpoint, with features like SSL offloading and WAF. Azure Front Door would be the correct choice.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway establishes encrypted connectivity between on-premises networks and Azure virtual networks. While it allows secure private access, administrators would still need a jump-box or a VM with a public IP to initiate RDP from the portal, and the VMs themselves would typically require private IP connectivity, not portal-based RDP without a public IP.
When this WOULD be correct
A company needs to connect on-premises networks to Azure VNet securely over the internet using IPsec/IKE VPN tunnels, and they want to allow remote users to connect to Azure VMs via VPN client without exposing VMs to the public internet.
- ✗
Azure ExpressRoute
Why it's wrong here
Azure ExpressRoute provides a dedicated private network connection from on-premises to Azure, bypassing the public internet. However, it does not offer direct RDP/SSH access from the Azure portal; administrators would still need a jump-box or a VM with a public IP, and it adds complexity and cost unrelated to the stated requirements.
When this WOULD be correct
A company needs a dedicated, private, and high-bandwidth connection between their on-premises data center and Azure, with higher reliability and lower latency than internet-based VPNs, and they want to avoid data traversing the public internet. ExpressRoute would be the correct answer for such a hybrid connectivity requirement.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BastionCorrect answer▾
Why this is correct
Azure Bastion is a fully managed PaaS service that provides secure RDP and SSH access to Azure virtual machines directly from the Azure portal, without exposing the VMs via public IP addresses. It eliminates the need for a separate jump-box VM and reduces management overhead, making it the correct choice for this scenario.
✗Azure Front DoorWrong answer — click to see why▾
Why this is wrong here
Azure Front Door is a global load balancer and application delivery controller, not a service for secure RDP access to VMs without public IPs. It operates at the application layer (HTTP/HTTPS) and does not provide native RDP connectivity.
★ When this WOULD be the correct answer
A company wants to improve the performance and availability of a global web application by routing user traffic to the nearest backend endpoint, with features like SSL offloading and WAF. Azure Front Door would be the correct choice.
Why candidates choose this
Candidates may confuse Azure Front Door's 'front door' name with a gateway for accessing VMs, or mistakenly think it can handle RDP traffic because it provides secure access to applications.
✗Azure VPN GatewayWrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway provides site-to-site or point-to-site VPN connectivity, but it requires the VMs to have private IP addresses reachable from the VPN client, and it does not eliminate the need for public IPs on the VMs or provide RDP access directly from the Azure portal without a public IP.
★ When this WOULD be the correct answer
A company needs to connect on-premises networks to Azure VNet securely over the internet using IPsec/IKE VPN tunnels, and they want to allow remote users to connect to Azure VMs via VPN client without exposing VMs to the public internet.
Why candidates choose this
Candidates might think VPN Gateway provides secure remote access to VMs, similar to Bastion, but they overlook that VPN Gateway still requires VMs to have private IPs and does not offer browser-based RDP/SSH from the portal.
✗Azure ExpressRouteWrong answer — click to see why▾
Why this is wrong here
Azure ExpressRoute provides a private, dedicated connection from on-premises to Azure, but it does not enable RDP connectivity to VMs without public IPs from the Azure portal. It requires additional routing and gateway configurations, and does not offer browser-based RDP access.
★ When this WOULD be the correct answer
A company needs a dedicated, private, and high-bandwidth connection between their on-premises data center and Azure, with higher reliability and lower latency than internet-based VPNs, and they want to avoid data traversing the public internet. ExpressRoute would be the correct answer for such a hybrid connectivity requirement.
Why candidates choose this
Candidates may mistakenly think ExpressRoute provides direct RDP access because it creates a private network path, but they overlook that it does not include a bastion service for browser-based RDP and still requires public IPs or a jump box for VM connectivity.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
Azure Bastion
Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP and SSH connectivity to virtual machines directly through the Azure portal without exposing public IP addresses.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.