AZ-104 Question 225
Select 2Your organization has an Azure virtual network (VNet) in the East US region with an address space of 10.1.0.0/16. You want to deploy Azure Bastion to enable secure RDP/SSH connections to multiple Windows and Linux virtual machines within the VNet. The VMs do not have public IP addresses, and you want to keep them inaccessible from the Internet via direct inbound connections. Which two actions must you take to implement Azure Bastion in this scenario?
- A
Create a dedicated subnet named AzureBastionSubnet with a /27 or larger address space to host the Bastion service
- B
Deploy an Application Gateway in front of the virtual network and enable the Bastion feature on it
- C
Configure a custom NSG that blocks all inbound traffic from the Internet on the Bastion subnet
- D
Assign a Public IP address resource to the Bastion host during deployment
Show answer and explanation
Correct answers: A, D
Explanation
Azure Bastion requires its own subnet named AzureBastionSubnet (with at least /27) and a Public IP address on the Bastion resource. This setup allows secure, browser-based RDP/SSH to VMs without assigning public IP addresses to the VMs themselves.
- A. Correct.
A dedicated subnet named AzureBastionSubnet with at least /27 is mandatory for Azure Bastion to function correctly. This is a required naming convention and size requirement.
- B. Incorrect.
Azure Bastion is not deployed via Application Gateway; it is a separate PaaS service that must be provisioned independently.
- C. Incorrect.
While you can use an NSG, you cannot block all inbound traffic on the Bastion subnet because Azure Bastion needs inbound connectivity for management traffic (HTTPS/443).
- D. Correct.
You must associate a Public IP address with the Azure Bastion resource so that remote connections can be established over HTTPS, without exposing the individual VMs to the Internet.