AZ-104 Question 223
Single answerYou are an Azure Administrator for an organization that wants to enable secure RDP and SSH connections to Azure VMs in a virtual network. You have decided to implement Azure Bastion to eliminate the need for public IP addresses and reduce the attack surface. Which of the following tasks is required for deploying Azure Bastion so you can connect to your VMs using the Azure portal?
- A
Create a dedicated subnet named AzureBastionSubnet with at least a /27 address space in the same virtual network
- B
Configure an NSG that explicitly allows inbound TCP port 3389 from the Internet
- C
Assign a public IP address directly to each VM
- D
Enable multi-factor authentication on all VMs prior to deployment
Show answer and explanation
Correct answer: A
Explanation
Azure Bastion requires a specific subnet named AzureBastionSubnet in the virtual network with a minimum address space of /27. This configuration allows you to securely connect to your VMs over RDP and SSH through the Azure portal without having to expose any public IP addresses or open ports in your network security groups.
- A. Correct.
This is correct because Azure Bastion requires a dedicated subnet named AzureBastionSubnet. It must have at least a /27 address space and be in the same virtual network as the VMs you want to connect to.
- B. Incorrect.
Azure Bastion eliminates the need to open inbound RDP/SSH ports from the Internet. You do not need to configure an NSG explicitly allowing inbound TCP port 3389.
- C. Incorrect.
Azure Bastion provides secure connectivity without the need for public IP addresses on each VM, so assigning a public IP address is not required.
- D. Incorrect.
While multi-factor authentication can enhance security, it is not a mandatory requirement for deploying Azure Bastion.