AZ-700 Question 276
Select 2Your organization has deployed Azure Bastion to securely manage multiple Linux and Windows VMs in a dedicated subnet within an Azure virtual network. You want to ensure that all direct SSH/RDP access from the internet is blocked, and only connections through Azure Bastion are allowed. How should you configure the NSG rules on the VMs� subnet to meet these requirements?
- A
- Create an inbound security rule that allows traffic on ports 22 and 3389 from the 'AzureBastion' service tag with a higher priority than any deny rules.
- B
- Create an inbound security rule that allows SSH and RDP from any source with top priority to keep management straightforward.
- C
- Deny inbound traffic on ports 22 and 3389 from all sources except the Azure Bastion service tag, placing the deny rule at a lower priority to override the default allow rules.
- D
- Configure an inbound rule that only allows SSH and RDP connections from your on-premises IP ranges at the highest priority, while ignoring Azure Bastion entirely.
- E
- Open inbound port 443 on the VM subnet NSG so that Azure Bastion can connect through HTTPS directly to the VMs.
Show answer and explanation
Correct answers: A, C
Explanation
Azure Bastion provides secure RDP/SSH connectivity without exposing these ports to the public internet. Configuring the NSG to allow inbound traffic from the 'AzureBastion' service tag ensures that only Bastion-initiated connections can reach the VMs. All other direct inbound SSH/RDP traffic should be blocked. For more information on best practices, refer to Microsoft� documentation on Azure Bastion and NSG configuration: https://learn.microsoft.com/azure/bastion/bastion-nsg.
- A. Correct.
Correct. When using Azure Bastion, you should allow traffic from the 'AzureBastion' service tag on RDP (3389) and SSH (22) ports to the VMs. This ensures that only Bastion-initiated traffic can flow to these ports.
- B. Incorrect.
Incorrect. Allowing SSH and RDP from any source overexposes your VMs to the internet, which contradicts the requirement to block direct inbound connections.
- C. Correct.
Correct. You must block all other inbound traffic on ports 22 and 3389 while allowing only the Azure Bastion service tag at a higher priority, ensuring VMs are accessible through Bastion but not directly from the internet.
- D. Incorrect.
Incorrect. While restricting access to on-premises IPs is a valid security measure in some scenarios, this approach ignores Azure Bastion entirely and does not meet the requirement to utilize it as the sole remote access method.
- E. Incorrect.
Incorrect. Azure Bastion manages inbound connections on port 443 at the Bastion service itself; you do not need to open port 443 directly on the VM subnet NSG for Bastion-to-VM communication.