AZ-802 Secure Windows Server Infrastructure Practice Question
You are configuring Azure Bastion to provide secure RDP access to your Windows Server VMs in an Azure Virtual Network. Which THREE requirements must be met for a successful deployment? (Select THREE)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A subnet named 'AzureBastionSubnet' must exist in the Virtual Network.
Azure Bastion is a managed PaaS service that provides secure RDP and SSH access. It requires a dedicated subnet named 'AzureBastionSubnet' with a minimum mask of /26. Additionally, it requires a Public IP address for the Bastion resource itself. This setup ensures that your VMs do not need public IP addresses for administrative access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A subnet named 'AzureBastionSubnet' must exist in the Virtual Network.
Why this is correct
Azure Bastion requires a specifically named subnet, 'AzureBastionSubnet', to host the Bastion gateway resources. This subnet is reserved for the service and cannot contain other resources like virtual machines. Correct naming is mandatory for the Azure portal and backend services to identify and deploy the Bastion infrastructure correctly.
- ✓
The 'AzureBastionSubnet' must have a prefix of at least /26.
Why this is correct
Microsoft requires the AzureBastionSubnet to have a prefix of at least /26 (e.g., /26, /25, etc.) to ensure there are enough IP addresses for the service to scale. A smaller subnet, like /27 or /28, will result in a deployment failure because it cannot accommodate the required number of instances.
- ✓
A Public IP address must be associated with the Azure Bastion resource.
Why this is correct
To allow users to connect via the Azure portal over the internet, the Azure Bastion resource requires a Public IP address. This Public IP acts as the entry point for the encrypted traffic. Once the connection reaches Bastion, it is then routed internally to your private virtual machines over the network.
- ✗
All target Windows Servers must have the Remote Desktop Gateway role installed.
Why it's wrong here
One of the primary benefits of Azure Bastion is that it eliminates the need for a Remote Desktop Gateway role or any other public-facing agent on your virtual machines. The Bastion service itself handles the gateway functionality, allowing you to keep your VMs isolated from the internet while still maintaining administrative access.
- ✗
A Site-to-Site VPN must be established between Azure and on-premises.
Why it's wrong here
Azure Bastion is a standalone service that provides access through the Azure portal via a web browser. It does not require a Site-to-Site VPN or ExpressRoute to function. While those technologies are useful for general hybrid connectivity, Bastion specifically focuses on providing secure, clientless RDP/SSH access without needing a VPN.
Visual reference
About these practice questions
One of 116 original AZ-802 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.