Azure Bastion Hosts for Peered VNets
You have an Azure Virtual Desktop deployment that contains the host pools shown in the following table. VNet1, VNet2, and VNet3 are peered. You plan to use Azure Bastion to provide secure administrative access to all the session hosts. The solution must minimize costs. How many Azure Bastion hosts should you deploy? - 
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Azure Bastion can access VMs across peered VNets, so a single deployment covers all connected networks, avoiding the common trap of deploying one per VNet.
Deploying a single Azure Bastion host in a peered virtual network topology provides secure administrative access to all session hosts while minimizing costs. This page establishes that Azure Bastion natively supports VNet peering, making multiple deployments unnecessary.
Deploying 3 Bastion hosts (one per VNet) because of the assumption that Bastion only works within its own deployed VNet.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Azure Bastion can be deployed into a single virtual network and natively supports connectivity to virtual machines in peered virtual networks, including both regional and global peering. Because VNet1, VNet2, and VNet3 are peered, deploying just one Azure Bastion host in any of these networks allows administrative access to all session hosts across the entire deployment. This configuration directly satisfies the requirement to minimize costs by avoiding redundant Bastion deployments.Why the Other Options Are Wrong
Deploying 2 or 3 Azure Bastion hosts would unnecessarily increase costs without providing any additional functional benefit, since one host can already reach all peered networks. Deploying 4 hosts exceeds the number of virtual networks available and is entirely illogical. The options suggesting multiple deployments rely on the false assumption that Bastion is restricted to its local VNet.Community Comment Notes
The community correctly highlights that Azure Bastion works across peered networks, with jeff1988 noting "Azure Bastion works with any type of Peering". Another user cited the official documentation confirming that both regional and global virtual network peering are supported, reinforcing that a single deployment is sufficient.Official Reference
Exam Strategy
When asked to minimize costs for Azure Bastion across multiple VNets, check if the VNets are peered. If they are, a single Bastion deployment in one VNet can cover all peered VNets, eliminating the need for multiple deployments.
Related Analysis
Practice All AZ-140 Questions
Access 64 questions with complete answers and detailed explanations.
View Full AZ-140 Practice Test →