Using Virtual Network Manager security admin rules to force Bastion-only RDP

SC-100 By islever Editorial Last updated Sep 25, 2026

Evaluate solutions for network security and Security Service Edge (SSE)

Short answer

A VNet Manager security admin rules override NSGs and can centrally block direct RDP, forcing Bastion-only access.

Question

You have an Azure subscription that contains multiple network security groups (NSGs), multiple virtual machines, and an Azure Bastion host named bastion1. Several NSGs contain rules that allow direct RDP access to the virtual machines by bypassing bastion1. You need to ensure that the virtual machines can be accessed only by using bastion1. The solution must prevent the use of NSG rules to bypass bastion1. What should you include in the solution?

Azure Virtual Network Manager security admin rules Correct Answer
Azure Virtual Network Manager connectivity configurations
Azure Firewall application rules
Azure Firewall network rules

Key Takeaways

Security admin rules in VNet Manager override NSG rules, so they can centrally block direct RDP irrespective of per-NSG allow rules; Azure Firewall rules do not override NSGs the same way.

To ensure VMs are reachable only through Azure Bastion and block direct RDP that bypasses it, use Azure Virtual Network Manager security admin rules, which take precedence over NSGs and centrally deny direct RDP.

Common mistake: Choosing Azure Firewall rules (C/D) — they filter traffic but do not take precedence over NSGs, so direct-RDP NSG allows could still bypass Bastion.

Expert Analysis

Why the Answer Is Correct

Azure Virtual Network Manager security admin rules are evaluated above (have precedence over) network security groups, so they can centrally block direct RDP to the VMs regardless of any permissive NSG rules, forcing all RDP access through Azure Bastion.

Why the Other Options Are Wrong

Azure Firewall application (C) and network (D) rules filter traffic but do not override NSG rules, so a direct-RDP allow rule in an NSG could still bypass Bastion. Connectivity configurations (B) design connectivity, not security enforcement.

Community Comment Notes

The community favored A (83 votes). Comments note that security admin rules take precedence over NSGs, which is exactly what is needed to prevent NSG-based bypass of Bastion; a minority (C, 17 votes) suggested Azure Firewall.

Official Reference

https://learn.microsoft.com/en-us/azure/virtual-network-manager/overview

This link opens the official vendor documentation in a new tab.

Community Votes

83%

17%

83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

Er_01 👍 3 Answered A

Security admin rules take precedence over NSGs.
tuyi2 👍 2 Answered A

https://learn.microsoft.com/en-us/azure/virtual-network-manager/overview
676ae1a 👍 1 Answered C

Las reglas de aplicación de Azure Firewall te permiten definir y controlar de manera granular el tráfico de red basado en aplicaciones específicas. Puedes configurar las reglas de aplicación para bloquear cualquier intento de acceso RDP directo a las máquinas virtuales que no pase por bastion1. Utilizando Azure Firewall, puedes centralizar la gestión de seguridad y asegurarte de que todas las políticas se apliquen de manera coherente.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide