easyMultiple Choice
SC-100 Practice Question: Deploy Azure Virtual Desktop (AVD) in a secure…
A company plans to deploy Azure Virtual Desktop (AVD) in a secure environment. They require that all user connections be established over a reverse connect protocol to avoid inbound firewall rules. Which component enables this?
⚠ Common exam trap
Candidates often confuse Azure Bastion's secure RDP access with AVD's reverse connect, but Bastion still requires inbound connectivity to the bastion host and does not provide the same outbound-only connection model that eliminates inbound firewall rules for session hosts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AVD Gateway service
The AVD Gateway service is the correct component because it establishes a reverse connect transport, where the session host initiates an outbound connection to the gateway over HTTPS (port 443). This eliminates the need for any inbound firewall rules to the session hosts, as user connections are relayed through the gateway without directly exposing the session hosts to the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a managed PaaS service that provides secure RDP/SSH access to Azure VMs through the Azure portal using TLS, eliminating the need for public IP addresses on the VMs. However, it requires a direct network path from Bastion to the VM's private IP address and does not use the reverse-connect transport that AVD relies on. Bastion is designed for administrative VM management, not for brokering or relaying user sessions, so it cannot handle the AVD gateway's role in establishing outbound session-host connections or integrating with AVD host pools.
- ✗
Microsoft Entra application proxy
Why it's wrong here
Microsoft Entra application proxy is an HTTP/HTTPS reverse proxy for providing remote access to on-premises web applications, using an agent connector and Microsoft Entra ID pre-authentication. It does not support the RDP or UDP display protocols used by AVD, nor does it understand the AVD brokering and session-management messages. Even with an HTML5 client, AVD requires a gateway that can relay Remote Desktop protocol traffic and coordinate with session hosts, which Application Proxy is not designed to do, making it unsuitable for AVD connectivity.
- ✓
AVD Gateway service
Why this is correct
The AVD Gateway service is the correct answer because it implements reverse-connect transport, where each session host initiates an outbound connection to the gateway. This allows clients to connect to the gateway, which then relays the Remote Desktop traffic over the already-established outbound channel, preventing the need for any inbound ports on session hosts. The gateway also handles brokering, load balancing, and protocol translation, providing a scalable and secure path for AVD user connections.
- ✗
Session host configuration
Why it's wrong here
Session host configuration refers to the settings on the Windows VMs that actually host desktops or apps, such as joining the AVD host pool, installing the virtualization agent, and setting up the image and user profiles. While session hosts are essential to AVD, they are not the mechanism for client connectivity; in fact, they are normally configured without public IP addresses and only make outbound calls to the AVD service. The connectivity model is provided by the AVD gateway via reverse connect, not by anything configured directly on the session host, so this option is incorrect.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 605-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.