Azure Bastion Hosts for Peered VNets

AZ-140 Last updated

Plan, implement, and manage networking for Azure Virtual Desktop

Short answer

A Deploy one Azure Bastion host in any of the peered VNets to provide secure access to all session hosts while minimizing costs.

Question

You have an Azure Virtual Desktop deployment that contains the host pools shown in the following table. VNet1, VNet2, and VNet3 are peered. You plan to use Azure Bastion to provide secure administrative access to all the session hosts. The solution must minimize costs. How many Azure Bastion hosts should you deploy? - Exhibit: Azure Bastion Hosts for Peered VNets

  1. 1 Correct Answer
  2. 2
  3. 3
  4. 4

Key Takeaways

Azure Bastion can access VMs across peered VNets, so a single deployment covers all connected networks, avoiding the common trap of deploying one per VNet.

Deploying a single Azure Bastion host in a peered virtual network topology provides secure administrative access to all session hosts while minimizing costs. This page establishes that Azure Bastion natively supports VNet peering, making multiple deployments unnecessary.

Common mistake: Deploying 3 Bastion hosts (one per VNet) because of the assumption that Bastion only works within its own deployed VNet.

Expert Analysis

Why the Answer Is Correct

Azure Bastion can be deployed into a single virtual network and natively supports connectivity to virtual machines in peered virtual networks, including both regional and global peering. Because VNet1, VNet2, and VNet3 are peered, deploying just one Azure Bastion host in any of these networks allows administrative access to all session hosts across the entire deployment. This configuration directly satisfies the requirement to minimize costs by avoiding redundant Bastion deployments.

Why the Other Options Are Wrong

Deploying 2 or 3 Azure Bastion hosts would unnecessarily increase costs without providing any additional functional benefit, since one host can already reach all peered networks. Deploying 4 hosts exceeds the number of virtual networks available and is entirely illogical. The options suggesting multiple deployments rely on the false assumption that Bastion is restricted to its local VNet.

Community Comment Notes

The community correctly highlights that Azure Bastion works across peered networks, with jeff1988 noting "Azure Bastion works with any type of Peering". Another user cited the official documentation confirming that both regional and global virtual network peering are supported, reinforcing that a single deployment is sufficient.

Official Reference

https://learn.microsoft.com/en-us/azure/bastion/vnet-peering

Exam Strategy

When asked to minimize costs for Azure Bastion across multiple VNets, check if the VNets are peered. If they are, a single Bastion deployment in one VNet can cover all peered VNets, eliminating the need for multiple deployments.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.

From public community threads 4

  1. jeff1988 👍 4 Answered A
    Azure Bastion works with any type of Peering and since VNET1, VNET2 and VNET3 are peered together 1 Azure Bastion service is enough.
  2. soysoliscarlos 👍 2 Answered A
    A. 1 According to the documentation (https://learn.microsoft.com/en-us/azure/bastion/vnet-peering): Azure Bastion works with the following types of peering: Virtual network peering: Connect virtual networks within the same Azure region. Global virtual network peering: Connecting virtual networks across Azure regions. So, we will set up a "Global virtual network peering"
  3. kam247 👍 2
    A - Is correct answer. https://learn.microsoft.com/en-us/azure/bastion/vnet-peering
  4. 2a6c244 👍 1 Answered B
    It seems incorrect, I think the correct answer is B https://learn.microsoft.com/en-us/azure/bastion/vnet-peering

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which Storage Accounts Can Host FSLogix Profile Containers?

S-Grade

First Step for AVD Reauthentication in New Subscription

S-Grade

Does the Owner Role Let Admin1 Assign Scaling1 to Pool1?

S-Grade

Practice All AZ-140 Questions

Access 64 questions with complete answers and detailed explanations.

View Full AZ-140 Practice Test →

← Back to AZ-140 Study Guide