VMs must be administered via RDP/SSH but should never expose public IPs or inbound ports to the internet. What provides secure browser-based connectivity?
A.Azure Bastion
Bastion = no public IPs, browser-based RDP/SSH. Correct.
B.Just-in-time VM access
JIT reduces the time window but ports still must be reachable.
C.A public IP with NSG restrictions
Still exposes an inbound path — contradicts the requirement.
D.Serial console
Serial console is for boot/OS-level debugging, not standard admin.
Why this answer
Azure Bastion is a fully managed PaaS providing RDP/SSH over TLS through the Azure portal — no public IP needed on the VM. JIT access limits exposure windows but still requires reachable ports; serial console is a debug channel, not a general admin path.
Correct answer: A · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Compute Deployment practice session.
Practice Compute Deployment