You have an Azure subscription that contains 20 virtual machines, a network security group (NSG) named NSG1, and two virtual networks named VNET1 and VNET2 that are peered. You plan to deploy an…

The correct answer is B. 443. https://learn.microsoft.com/en-us/azure/bastion/bastion-nsg Ingress Traffic: Ingress Traffic from public internet: The Azure Bastion will create a public IP that needs port 443 enabled on the public IP for ingress traffic. Port 3389/22 are NOT required to be opened on the…

Submitted by the_admin· Mar 4, 2026Configure and manage virtual networking

Question

You have an Azure subscription that contains 20 virtual machines, a network security group (NSG) named NSG1, and two virtual networks named VNET1 and VNET2 that are peered. You plan to deploy an Azure Bastion Basic SKU host named Bastion1 to VNET1. You need to configure NSG1 to allow inbound access to the virtual machines via Bastion1. Which port should you configure for the inbound security rule?

Options

A22
B443
C389
D8080

How the community answered

(22 responses)

A
18% (4)
B
73% (16)
C
5% (1)
D
5% (1)

Explanation

https://learn.microsoft.com/en-us/azure/bastion/bastion-nsg Ingress Traffic: Ingress Traffic from public internet: The Azure Bastion will create a public IP that needs port 443 enabled on the public IP for ingress traffic. Port 3389/22 are NOT required to be opened on the AzureBastionSubnet. Note that the source can be either the Internet or a set of public IP addresses that you specify. Egress Traffic to target VMs: Azure Bastion will reach the target VMs over private IP. The NSGs need to allow egress traffic to other target VM subnets for port 3389 and 22. If you are using the custom port feature as part of Standard SKU, the NSGs will instead need to allow egress traffic to other target VM subnets for the custom value(s) you have opened on your target VMs.

Community Discussion

No community discussion yet for this question.

Full AZ-104 Practice