nerdexam
Microsoft

SC-200 · Question #133

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a resource group named RG1. RG1 contains 20 virtual machines that run Windows Server 2019. You need to configure…

The correct answer is D. Azure Bastion. Azure Bastion provides browser-based RDP and SSH access to VMs through the Azure portal without ever exposing management ports (like RDP 3389) to the public internet. It meets all three requirements: it naturally restricts connections to RDP and SSH only - satisfying the 'RDP…

Submitted by haru.x· Apr 18, 2026

Question

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a resource group named RG1. RG1 contains 20 virtual machines that run Windows Server 2019. You need to configure just-in-time (JIT) access for the virtual machines in RG1. The solution must meet the following requirements:

  • Limit the maximum request time to two hours.
  • Limit protocols access to Remote Desktop Protocol (RDP) only.
  • Minimize administrative effort.

What should you use?

Options

  • AAzure AD Privileged Identity Management (PIM)
  • BAzure Policy
  • CAzure Front Door
  • DAzure Bastion

How the community answered

(48 responses)
  • A
    10% (5)
  • B
    6% (3)
  • C
    2% (1)
  • D
    81% (39)

Explanation

Azure Bastion provides browser-based RDP and SSH access to VMs through the Azure portal without ever exposing management ports (like RDP 3389) to the public internet. It meets all three requirements: it naturally restricts connections to RDP and SSH only - satisfying the 'RDP only' protocol requirement; it supports session-based time-limited access satisfying the 2-hour maximum request window; and a single Bastion host deployed in the virtual network serves all VMs in that VNet, avoiding per-VM JIT policy configuration and minimizing administrative effort for 20 VMs. Azure AD PIM (A) manages privileged Azure AD role assignments, not VM network-level access. Azure Policy (B) enforces governance standards but does not provide an access gateway. Azure Front Door (C) is a global web application delivery and CDN service, irrelevant to VM management access.

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice