AZ-700 Question 275
Single answerYou have deployed Azure Bastion within a virtual network to securely connect to an Azure VM for RDP-based management. The VM's subnet is protected by a network security group (NSG). You need to ensure that direct RDP traffic from the public internet is blocked, while still permitting RDP connections through Azure Bastion for remote administration. Which configuration should you implement on the NSG?
- A
Allow inbound RDP (TCP/3389) only from the AzureBastionSubnet and deny RDP traffic from all other sources.
- B
Allow inbound RDP (TCP/3389) from the internet, but limit it to a specific public IP address range.
- C
Allow inbound HTTPS (TCP/443) traffic from the internet directly to the VM, assuming Azure Bastion will tunnel RDP over 443.
- D
Deny all inbound traffic and rely on Azure Bastion to bypass the NSG rules for RDP access.
Show answer and explanation
Correct answer: A
Explanation
Azure Bastion provides a secure jump station to your VM using an internal IP address. Microsoft recommends blocking direct RDP or SSH ports from the public internet and only allowing inbound connections from the AzureBastionSubnet to those management ports in your NSG. Reference: Microsoft Azure documentation on configuring Azure Bastion and NSGs (docs.microsoft.com/azure/bastion/bastion-overview).
- A. Correct.
Correct. Azure Bastion connects to the target VM from the AzureBastionSubnet. You should allow RDP inbound only from that subnet and block all other sources to prevent direct internet exposure.
- B. Incorrect.
Incorrect. Allowing RDP from the internet, even to a limited range, still leaves the VM more exposed than needed. With Azure Bastion, there is no requirement to open RDP from the internet at all.
- C. Incorrect.
Incorrect. Although Azure Bastion uses port 443 for the Azure Bastion gateway itself, you do not need to open port 443 on the VM� NSG for direct inbound traffic from the internet. The Azure Bastion service handles that externally.
- D. Incorrect.
Incorrect. Azure Bastion does not bypass NSG rules; the NSG must allow inbound traffic from the AzureBastionSubnet for RDP. Simply denying all inbound traffic would block the legitimate RDP flow from Bastion.