Examkin

Question

Difficulty: MediumConfigure Azure Bastion

An administrator needs to configure secure administrative access to virtual machines in a virtual network named `VNet-Secure`. The virtual network currently contains a single workload subnet and no other resources. The administrator plans to secure the Bastion subnet with a Network Security Group (NSG).

What is the correct sequence of steps to configure the virtual network environment and establish a secure connection using Azure Bastion?

  1. 1Create a subnet named `AzureBastionSubnet` with an address space of at least /26/26 inside the virtual network.
  2. 2Associate a Network Security Group (NSG) configured with the required inbound and outbound Bastion rules to the `AzureBastionSubnet`.
  3. 3Deploy the Azure Bastion host resource in the `AzureBastionSubnet` using a Standard SKU public IP address.
  4. 4Navigate to the target virtual machine in the Azure portal and initiate a secure RDP or SSH connection through the browser.

Answer

To configure and use Azure Bastion, first create the dedicated `AzureBastionSubnet` with a prefix of at least /26/26. Next, configure and associate a Network Security Group (NSG) with the required inbound and outbound rules to this subnet. Then, deploy the Azure Bastion host using a Standard SKU public IP address. Finally, connect to the target virtual machine from the Azure portal.
The correct sequence begins with creating the dedicated `AzureBastionSubnet` with a prefix of /26/26 or larger. Before deploying the Bastion host, any associated Network Security Group (NSG) must be configured with the mandatory rules (such as inbound HTTPS from GatewayManager) and linked to the subnet to pass deployment validation. Once the network infrastructure is ready, the Azure Bastion host is deployed using a Standard SKU public IP. Finally, the administrator can initiate a secure RDP or SSH session to target virtual machines.

Step-by-Step Solution

1
Add a subnet named `AzureBastionSubnet` with a prefix of /26/26 or larger.
The dedicated subnet is created, defining the address space for the Bastion service.
Azure Bastion requires a dedicated subnet named exactly `AzureBastionSubnet` with at least a /26/26 prefix.
2
Associate an NSG with the mandatory security rules to the `AzureBastionSubnet`.
The subnet is secured, and Azure will pass NSG validation during Bastion deployment.
If an NSG is associated with the `AzureBastionSubnet`, Azure validates its rules during the Bastion host provisioning phase.
3
Provision the Azure Bastion host using a Standard SKU public IP address.
The Bastion host is deployed and running in the `AzureBastionSubnet`.
The Bastion host requires a pre-existing subnet and a Standard SKU public IP to deploy.
4
Connect to the target virtual machine via the Connect blade in the Azure portal.
A secure RDP or SSH session is established in the browser.
The session relies on the running Bastion host to proxy the connection over HTTPS (443443).

Key Concept

Deploying Azure Bastion requires a dedicated subnet named exactly `AzureBastionSubnet` with a prefix of /26/26 or larger. If a Network Security Group (NSG) is associated with this subnet, it must contain specific mandatory rules (such as allowing HTTPS from GatewayManager inbound) to pass deployment validation. The Bastion host also requires a Standard SKU public IP address.
Estimated Time:2m 0s
Rate this question

Topics

Configure Azure Bastion

More questions from this topic