SC-100 Certification Practice Question #172

Question

You have an Azure subscription that contains multiple network security groups (NSGs), multiple virtual machines, and an Azure Bastion host named bastion1.

Several NSGs contain rules that allow direct RDP access to the virtual machines by bypassing bastion1.

You need to ensure that the virtual machines can be accessed only by using bastion1. The solution must prevent the use of NSG rules to bypass bastion1.

What should you include in the solution?

Accepted Answer

The requirement is twofold — force all access through bastion1 AND prevent the existing NSG allow rules from bypassing it. Only Azure Virtual Network Manager security admin rules sit *above* NSGs in the evaluation order: per MS Learn they are evaluated before NSG rules and a Deny security admin rule (e.g., inbound TCP 3389/RDP) cannot be overridden by an NSG allow rule. This is exactly the "prevent the use of NSG rules to bypass" condition. Azure Firewall (C/D) is not present in the environment and, even if added, its rules do not take precedence over an NSG that allows direct RDP. Connectivity configurations (B) only manage peering. Suggested Answer, Most Voted, the top-voted comment, and MS Learn all converge on A.

More SC-100 practice questions