SC-100 Certification Practice Question #153

Question

You have an Azure subscription that contains virtual machines.
Port 3389 and port 22 are disabled for outside access.
You need to design a solution to provide administrators with secure remote access to the virtual machines. The solution must meet the following requirements:
✑ Prevent the need to enable ports 3389 and 22 from the internet.
✑ Only provide permission to connect the virtual machines when required.
✑ Ensure that administrators use the Azure portal to connect to the virtual machines.
Which two actions should you include in the solution? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

Azure Bastion satisfies two requirements simultaneously: administrators connect to VMs directly from the Azure portal over TLS, and no public RDP/SSH ports need to be opened on the VM (no public IP required), so ports 3389/22 stay closed to the internet. Just-in-time (JIT) VM access satisfies "only provide permission to connect when required" by granting time-limited, on-request access that is automatically revoked. The strongest community signal (CD, 17 votes, plus multiple 4-6 👍 confirmations) and both MS Learn references align. The CE camp argues PIM controls "permission only when required," but PIM scoped to VM Contributor grants an over-privileged management role rather than the interactive connection that JIT time-boxes, and a commenter explicitly notes VM Contributor does not provide connection access. The Suggested Answer lists only D, but the question needs two parts and Bastion is required to meet the "use the Azure portal" and "no internet ports" conditions. Confidence is held at 85 because of the real CE dissent and the partial official answer.

More SC-100 practice questions