Examkin

Question

Difficulty: EasyNetwork Security and Private Access

An organization needs to design a secure administration path for its development workloads. Developers must be able to establish Remote Desktop Protocol (RDP) connections to virtual machines over the internet. The solution must restrict public internet exposure by ensuring the virtual machines do not have public IP addresses, and it must avoid the management overhead of client-based virtual private network (VPN) software. Which service should you recommend to meet these requirements?

  1. Azure BastionAnswer
  2. B
    Azure Application Gateway
  3. C
    A Network Security Group with rules allowing inbound RDP traffic from explicit public IP addresses
  4. D
    Azure ExpressRoute

Answer

Azure Bastion
Azure Bastion is a fully platform-managed PaaS service that provides secure and seamless RDP and SSH access to virtual machines directly through the Azure portal. Since it operates as a gateway inside the virtual network, VMs do not require public IP addresses, and administrators do not need to install client-side VPN software.

Step-by-Step Solution

1
Analyze the access requirement
Administrators need to connect to Azure VMs using RDP over the internet.
This establishes the protocol and target environment for the administration connection.
2
Evaluate the connectivity and agent constraints
The VMs must not have public IP addresses, and no VPN client software should be installed on client machines.
This rules out direct RDP exposure (which requires public IPs or NAT) and traditional Point-to-Site VPNs (which require VPN client software).
3
Select the appropriate Azure service
Azure Bastion satisfies these conditions by provisioning a managed gateway that brokers RDP/SSH traffic over HTTPS (SSL) directly in the browser.
Azure Bastion allows secure connectivity without public IPs on virtual machines and without client-side VPN components.

Key Concept

Azure Bastion provides secure, clientless RDP/SSH access to virtual machines within a virtual network without exposing public IPs.
Rate this question

Topics

Network Security and Private Access

More questions from this topic