AZ-900 Describe Azure architecture and services Practice Question
A company has virtual machines in a virtual network that run a critical internal application. IT administrators need to securely connect to these VMs from the internet for management purposes. They must not assign public IP addresses to the VMs, and they want to avoid managing SSH or RDP endpoints. Which Azure service should they use?
⚠ Common exam trap
Many candidates confuse Azure Bastion with Azure VPN Gateway, thinking a VPN is required for secure remote access, but Bastion is specifically designed for browser-based RDP/SSH without public IPs or VPN complexity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Bastion
Azure Bastion provides secure and seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS, without exposing public IP addresses on the VMs. It eliminates the need for managing public endpoints, as the Bastion service is deployed inside the virtual network and acts as a jump server that brokers the connection. This meets the requirement of secure internet-based management without public IPs or manual SSH/RDP endpoint management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Bastion
Why this is correct
Azure Bastion is a fully managed PaaS service deployed inside the VNet that provides secure, browser-based RDP and SSH connectivity to VMs without exposing any public IP address. It leverages Transport Layer Security (TLS) on port 443, so you no longer need inbound RDP/SSH rules (3389/22) on NSGs, and it safeguards VMs from port-scanning attacks and zero-day exploits.
- ✗
Azure VPN Gateway
Why it's wrong here
Incorrect. VPN Gateway creates a site-to-site or point-to-site VPN connection. While it provides secure connectivity, it still requires routing traffic through a VPN client and does not offer the same seamless portal experience as Bastion. It also does not eliminate the need for RDP/SSH endpoints.
When this WOULD be correct
A company needs to connect its on-premises data center to Azure VNet securely over the internet, allowing on-premises users to access Azure resources as if they were on the local network, without exposing VMs to the public internet.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer operates at OSI Layer 4 to distribute inbound UDP/TCP traffic across VM backend pools based on load-balancing rules and health probes. It is designed for application traffic distribution and has no awareness of management protocols such as RDP or SSH. It does not provide user authentication, encryption, or a browser-based portal, and therefore cannot serve as a secure management access path.
When this WOULD be correct
A company needs to distribute incoming web traffic across multiple VMs in a backend pool for high availability and scalability, without requiring secure remote management access from the internet.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a managed, stateful firewall that filters north-south and east-west traffic using network and application rules. While it can block or allow traffic to management ports, it does not establish or broker an RDP/SSH session; it simply passes or denies packets. To reach a VM for administration you still need a separate remote-access mechanism, such as a public IP with just-in-time access, a VPN, or Bastion.
When this WOULD be correct
A company needs to inspect and filter inbound and outbound traffic to and from Azure virtual networks, and wants centralized network security policy enforcement across multiple subscriptions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BastionCorrect answer▾
Why this is correct
Azure Bastion is a fully managed PaaS service deployed inside the VNet that provides secure, browser-based RDP and SSH connectivity to VMs without exposing any public IP address. It leverages Transport Layer Security (TLS) on port 443, so you no longer need inbound RDP/SSH rules (3389/22) on NSGs, and it safeguards VMs from port-scanning attacks and zero-day exploits.
✗Azure VPN GatewayWrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway connects on-premises networks to Azure or connects VNets, but it does not provide RDP/SSH access to VMs without public IPs; it still requires managing endpoints and does not eliminate public IP exposure for individual VMs.
★ When this WOULD be the correct answer
A company needs to connect its on-premises data center to Azure VNet securely over the internet, allowing on-premises users to access Azure resources as if they were on the local network, without exposing VMs to the public internet.
Why candidates choose this
Candidates may think VPN Gateway provides secure remote access to VMs, but it is designed for site-to-site or point-to-site connectivity, not for direct RDP/SSH access without public IPs, and still requires managing endpoints.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer distributes inbound traffic to backend VMs but does not provide secure remote access (RDP/SSH) without public IPs or manage endpoints; it requires public IPs or a separate jump box for management access.
★ When this WOULD be the correct answer
A company needs to distribute incoming web traffic across multiple VMs in a backend pool for high availability and scalability, without requiring secure remote management access from the internet.
Why candidates choose this
Candidates may confuse load balancing with providing access to VMs, thinking that a load balancer can also serve as a secure entry point for management traffic.
✗Azure FirewallWrong answer — click to see why▾
Why this is wrong here
Azure Firewall is a network security service that filters traffic, not a tool for secure remote access to VMs without public IPs. It does not provide RDP/SSH connectivity.
★ When this WOULD be the correct answer
A company needs to inspect and filter inbound and outbound traffic to and from Azure virtual networks, and wants centralized network security policy enforcement across multiple subscriptions.
Why candidates choose this
Candidates may confuse Azure Firewall with Bastion because both involve securing network traffic, but Firewall lacks the direct VM connectivity feature required in this scenario.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure Bastion
Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP and SSH connectivity to virtual machines directly through the Azure portal without exposing public IP addresses.
Key term
Azure portal
The Azure portal is a web-based, unified console that lets you build, manage, and monitor everything from simple web apps to complex cloud deployments using a graphical user interface.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.