nerdexam
Microsoft

AZ-104 · Question #681

Hotspot Question You have an Azure subscription that contains the virtual networks shown in the following table. The subscription contains the subnets shown in the following table. The subscription…

The correct answer is The Remote Desktop Connection client (mstsc.exe) can be used to connect to VM1 through Bastion1. = Yes; The Azure portal can use SSH to connect to VM2 through Bastion1. = Yes; The Azure portal can be used to connect to VM3 through Bastion1. = No; Policy1 can be applied to Subnet3. = Yes; Only storage1 and storage2 can be accessed from VNet2. = No; Only storage2 can be accessed from VNet3. = No. This question tests knowledge of Azure Bastion connectivity options, service endpoint policies, and virtual network service endpoints. Azure Bastion supports both RDP (via mstsc.exe native client with Bastion Standard SKU) and SSH connections through the Azure portal, making…

Submitted by thandi_sa· Mar 4, 2026Configure and manage virtual networking - specifically Azure Bastion host connectivity methods (RDP/SSH via native client and portal) and the application and scope of VNet service endpoint policies for Azure Storage

Question

Hotspot Question You have an Azure subscription that contains the virtual networks shown in the following table. The subscription contains the subnets shown in the following table. The subscription contains the storage accounts shown in the following table. You create a service endpoint policy named Policy1 in the South Central US Azure region to allow connectivity to all the storage accounts in the subscription. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-104 question #681 exhibit 1
AZ-104 question #681 exhibit 2
AZ-104 question #681 exhibit 3
AZ-104 question #681 exhibit 4
AZ-104 question #681 exhibit 5
AZ-104 question #681 exhibit 6

Answer Area

  • The Remote Desktop Connection client (mstsc.exe) can be used to connect to VM1 through Bastion1.Yes
  • The Azure portal can use SSH to connect to VM2 through Bastion1.Yes
  • The Azure portal can be used to connect to VM3 through Bastion1.No
  • Policy1 can be applied to Subnet3.Yes
  • Only storage1 and storage2 can be accessed from VNet2.No
  • Only storage2 can be accessed from VNet3.No

Explanation

This question tests knowledge of Azure Bastion connectivity options, service endpoint policies, and virtual network service endpoints. Azure Bastion supports both RDP (via mstsc.exe native client with Bastion Standard SKU) and SSH connections through the Azure portal, making statements 1 and 2 correct. VM3 cannot be connected through Bastion1 if it resides in a VNet that does not have Bastion1 deployed or peered appropriately. Service endpoint policies can only be applied to subnets that have the Microsoft.Storage service endpoint enabled, and Subnet3 meets this criterion based on the table data. The final statement is No because service endpoint policies configured to allow 'all storage accounts in the subscription' would permit access to all storage accounts (storage1, storage2, and storage3), not just a subset.

Topics

#Azure Bastion#Service Endpoint Policies#Virtual Network Service Endpoints#Network Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-104 Practice