Examkin

Question

Difficulty: HardConfigure Azure Bastion

An administrator is configuring network security for a hub-and-spoke virtual network topology in Azure. The hub virtual network (VNet-Hub) contains an Azure Bastion host deployed in a subnet named `AzureBastionSubnet` (address prefix 10.1.0.0/26). The spoke virtual network (VNet-Spoke) hosts database virtual machines in a subnet named DB-Subnet (address prefix 10.2.0.0/24). VNet-Hub and VNet-Spoke are peered. You need to configure the Network Security Groups (NSGs) associated with both `AzureBastionSubnet` and DB-Subnet to allow administrators to establish RDP and SSH sessions to the database virtual machines using Azure Bastion. Which configuration should you apply to the NSGs?

  1. For `AzureBastionSubnet`, add an outbound NSG rule allowing traffic to the `VirtualNetwork` service tag on destination ports 3389 and 22. For DB-Subnet, add an inbound NSG rule allowing traffic from the `VirtualNetwork` service tag on destination ports 3389 and 22.Answer
  2. B
    For `AzureBastionSubnet`, add an outbound NSG rule allowing traffic to the `Internet` service tag on destination ports 3389 and 22. For DB-Subnet, add an inbound NSG rule allowing traffic from the `Internet` service tag on destination ports 3389 and 22.
  3. C
    For `AzureBastionSubnet`, add an inbound NSG rule allowing traffic from the `VirtualNetwork` service tag on destination port 443. For DB-Subnet, add an outbound NSG rule allowing traffic to the `VirtualNetwork` service tag on destination port 443.
  4. D
    For `AzureBastionSubnet`, add an outbound NSG rule allowing traffic to the `AzureCloud` service tag on destination ports 3389 and 22. For DB-Subnet, add an inbound NSG rule allowing traffic from the `AzureCloud` service tag on destination ports 3389 and 22.

Answer

For `AzureBastionSubnet`, add an outbound NSG rule allowing traffic to the `VirtualNetwork` service tag on destination ports 3389 and 22. For DB-Subnet, add an inbound NSG rule allowing traffic from the `VirtualNetwork` service tag on destination ports 3389 and 22.
The correct configuration establishes the necessary data path between the Bastion host and the peered spoke virtual machines. The Azure Bastion host initiates RDP (3389) and SSH (22) sessions outbound to target VMs. Therefore, `AzureBastionSubnet` requires an outbound rule allowing destination `VirtualNetwork` on ports 3389 and 22. In turn, the target spoke subnet (DB-Subnet) must allow inbound RDP/SSH traffic from the hub virtual network, which is represented by the `VirtualNetwork` service tag.

Step-by-Step Solution

1
Analyze Azure Bastion communication architecture in a peered network setup.
Azure Bastion connects to target VMs using RDP (port 3389) and SSH (port 22) through the virtual network peering connection.
Understanding the port requirements for the data path is necessary to determine the correct security rule rules.
2
Determine the required outbound NSG rule for the Bastion host subnet (`AzureBastionSubnet`).
An outbound rule allowing traffic to destination service tag `VirtualNetwork` on ports 3389 and 22 is required.
The `VirtualNetwork` service tag includes local and peered virtual networks, allowing Bastion to initiate RDP/SSH connections to spoke VMs.
3
Determine the required inbound NSG rule for the target subnet (DB-Subnet) in the spoke VNet.
An inbound rule allowing traffic from source service tag `VirtualNetwork` (or the specific hub Bastion subnet prefix) on ports 3389 and 22 is required.
The target VMs must accept incoming connection requests from the Bastion host on standard management ports.

Key Concept

Azure Bastion uses RDP (3389) and SSH (22) to connect to target virtual machines. In a peered virtual network configuration, the Network Security Groups (NSGs) for both the Bastion subnet and the target VM subnet must permit this outbound and inbound traffic using the `VirtualNetwork` service tag.
Rate this question

Topics

Configure Azure Bastion

More questions from this topic