AZ-800 AZ-800 - Microsoft Azure Networking Solutions Azure Bastion and DDoS Protection Questions and Answers 1 — Questions and Answers
Question 1: What is the primary purpose of Azure Bastion in a hybrid networking scenario?
- To provide secure RDP/SSH access to VMs without exposing them to the public internet (Correct answer)
- To replace VPN gateways for site-to-site connectivity
- To monitor network traffic with packet capture
- To route traffic between virtual networks
Correct answer: To provide secure RDP/SSH access to VMs without exposing them to the public internet
Azure Bastion provides browser-based RDP and SSH access to Azure VMs directly through the Azure portal without requiring a public IP on the VM.
Question 2: In which subnet must Azure Bastion be deployed within a virtual network?
- AzureBastionSubnet (Correct answer)
- GatewaySubnet
- ManagementSubnet
- BastionHostSubnet
Correct answer: AzureBastionSubnet
Azure Bastion requires a dedicated subnet named exactly 'AzureBastionSubnet' with a minimum size of /26.
Question 3: Which Azure Bastion SKU is required to use native client support and shareable links?
- Standard SKU (Correct answer)
- Basic SKU
- Developer SKU
- Premium SKU
Correct answer: Standard SKU
Azure Bastion Standard SKU unlocks native client (Azure CLI / RDP/SSH clients) and shareable links, which are not available on the Basic SKU.
Question 4: Azure Bastion is deployed in one VNet. Which feature allows it to connect to VMs in a peered VNet without deploying Bastion in each VNet?
- Bastion peering / IP-based connection (Correct answer)
- VNet-to-VNet gateway transit
- VPN Gateway shared Bastion
- Azure Firewall proxy
Correct answer: Bastion peering / IP-based connection
With Azure Bastion Standard SKU and VNet peering, Bastion can connect to VMs in peered VNets via IP-based connection without deploying a separate Bastion host.
Question 5: What network security recommendation should be applied to the AzureBastionSubnet NSG to allow the Bastion control plane?
- Allow inbound from GatewayManager service tag on port 443 (Correct answer)
- Allow all inbound traffic from the internet
- Deny all inbound traffic from Azure services
- Allow inbound from VirtualNetwork service tag on all ports
Correct answer: Allow inbound from GatewayManager service tag on port 443
The AzureBastionSubnet NSG must allow inbound HTTPS (port 443) from the GatewayManager service tag for Azure Bastion control plane communication.
Question 6: Which protocol does Azure Bastion use to transmit the RDP/SSH session between the user's browser and the Azure portal?
- HTTPS (TLS) over port 443 (Correct answer)
- RDP over port 3389 directly
- SSH over port 22 directly
- IPsec over UDP 500
Correct answer: HTTPS (TLS) over port 443
Azure Bastion tunnels RDP and SSH sessions over HTTPS (TLS) on port 443 through the browser, so no separate ports need to be opened.
AZ-800 AZ-800 - Microsoft Azure Networking Solutions Azure Bastion and DDoS Protection Questions and Answers 1
What is the primary purpose of Azure Bastion in a hybrid networking scenario?