AZ-104 Question 214
Single answerYou are an Azure Administrator for Contoso. You have a private virtual network hosting several Windows and Linux virtual machines. The security team requires administrators to be able to securely access these VMs via RDP and SSH without assigning any public IP addresses. They also prefer not to manage separate client VPN solutions. Which service should you implement to fulfill these requirements?
- A
Configure Just-in-Time (JIT) VM access in Microsoft Defender for Cloud
- B
Deploy Azure Firewall to allow inbound RDP/SSH traffic
- C
Deploy Azure Bastion for direct RDP/SSH connections
- D
Configure a site-to-site VPN with an on-premises gateway
Show answer and explanation
Correct answer: C
Explanation
Azure Bastion is specifically designed to provide secure, clientless RDP/SSH sessions to virtual machines within a virtual network without the need for public IPs or separate VPN connections. It satisfies the requirement to keep the VMs private while still allowing administrators to access them securely from the Azure portal.
- A. Incorrect.
While JIT access can restrict inbound traffic windows, it typically still requires either a public IP or another secure access method like a VPN or Bastion. JIT alone does not remove the need for a public endpoint.
- B. Incorrect.
Azure Firewall is useful for controlling inbound and outbound traffic, but you would still need a public access endpoint or a VPN solution to reach the private VMs.
- C. Correct.
Azure Bastion natively provides secure, browser-based RDP/SSH connections for VMs in a private VNet without requiring public IP addresses or a separate VPN client.
- D. Incorrect.
A site-to-site VPN would enable access to VMs, but this approach requires setting up and managing on-premises VPN hardware and connections, which the scenario states they prefer to avoid.