AZ-900 Describe Azure architecture and services Practice Question
A company has deployed several virtual machines in an Azure virtual network. The IT administrators need to connect to these VMs using RDP and SSH from the internet. However, the company's security policy prohibits assigning any public IP addresses to the VMs and also prohibits exposing the VMs directly to the internet. The solution must be fully managed by Azure and require no additional infrastructure in the virtual network. Which Azure service should the company use?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Bastion with a VPN gateway or jump box, thinking any VPN solution satisfies the 'no public IP' requirement, but Azure Bastion is the only fully managed service that provides RDP/SSH access without any public IP on the VMs and without additional infrastructure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Bastion
Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS. It eliminates the need for public IP addresses on the VMs and does not require any additional infrastructure in the virtual network, as it is deployed inside the virtual network and uses a private IP to connect to the VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Virtual Network Peering
Why it's wrong here
Azure Virtual Network Peering connects two virtual networks together, enabling traffic between them. It does not provide remote desktop or SSH connectivity to individual VMs, nor does it address the requirement of securing RDP/SSH access from the internet without public IPs.
When this WOULD be correct
When the question asks for connecting two Azure virtual networks in different regions to enable private IP communication between resources, without requiring a gateway or transit.
- ✓
Azure Bastion
Why this is correct
Azure Bastion is a fully managed service that provides secure RDP and SSH access to Azure VMs directly from the Azure portal, using TLS over the internet. It is deployed inside the virtual network and does not require public IP addresses on the VMs, perfectly meeting the security policy requirements.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway is used to create site-to-site or point-to-site VPN connections between on-premises networks and Azure. While it does allow secure access to VMs, it typically requires public IP addresses on the gateway, and VMs often still need public IPs for direct RDP/SSH unless additional routing is configured. It is not the optimal managed service for this specific scenario and still exposes the gateway to the internet.
When this WOULD be correct
A company needs to securely connect an on-premises network to an Azure virtual network over the internet, using site-to-site VPN with IPsec, and requires a fully managed VPN service without deploying third-party VPN appliances.
- ✗
Azure ExpressRoute
Why it's wrong here
Azure ExpressRoute provides a private, dedicated connection from an on-premises network to Azure, bypassing the public internet. However, it does not directly enable RDP/SSH access from the internet, and it requires significant on-premises infrastructure. It is not a fully managed solution for remote administrator access over the internet.
When this WOULD be correct
A company needs a dedicated, private, high-bandwidth connection between its on-premises data center and Azure, bypassing the internet for compliance or performance reasons, and is willing to set up the required networking equipment.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BastionCorrect answer▾
Why this is correct
Azure Bastion is a fully managed service that provides secure RDP and SSH access to Azure VMs directly from the Azure portal, using TLS over the internet. It is deployed inside the virtual network and does not require public IP addresses on the VMs, perfectly meeting the security policy requirements.
✗Azure Virtual Network PeeringWrong answer — click to see why▾
Why this is wrong here
Azure Virtual Network Peering connects virtual networks but does not provide secure RDP/SSH access from the internet without public IPs or direct exposure.
★ When this WOULD be the correct answer
When the question asks for connecting two Azure virtual networks in different regions to enable private IP communication between resources, without requiring a gateway or transit.
Why candidates choose this
Candidates may confuse peering with a remote access solution, thinking it can provide connectivity to VMs from the internet, but it only links networks.
✗Azure VPN GatewayWrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway connects on-premises networks to Azure via encrypted tunnels over the internet, but it does not provide RDP/SSH access to VMs without public IPs; it requires additional infrastructure like a jump box and does not eliminate the need for public IPs on the VMs.
★ When this WOULD be the correct answer
A company needs to securely connect an on-premises network to an Azure virtual network over the internet, using site-to-site VPN with IPsec, and requires a fully managed VPN service without deploying third-party VPN appliances.
Why candidates choose this
Candidates may think VPN Gateway provides secure remote access to VMs, confusing site-to-site VPN with the RDP/SSH proxy functionality that Azure Bastion offers.
✗Azure ExpressRouteWrong answer — click to see why▾
Why this is wrong here
Azure ExpressRoute extends on-premises networks into Azure over a private connection, not from the internet. It does not provide RDP/SSH access to VMs without public IPs and requires additional on-premises infrastructure.
★ When this WOULD be the correct answer
A company needs a dedicated, private, high-bandwidth connection between its on-premises data center and Azure, bypassing the internet for compliance or performance reasons, and is willing to set up the required networking equipment.
Why candidates choose this
Candidates may confuse ExpressRoute as a secure connectivity option for remote access, not realizing it's for site-to-site private connections, not individual VM access from the internet.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
Azure Bastion
Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP and SSH connectivity to virtual machines directly through the Azure portal without exposing public IP addresses.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.