Using Virtual Network Manager security admin rules to force Bastion-only RDP

Evaluate solutions for network security and Security Service Edge (SSE)
Answer Correct answer: A — VNet Manager security admin rules override NSGs and can centrally block direct RDP, forcing Bastion-only access.

You have an Azure subscription that contains multiple network security groups (NSGs), multiple virtual machines, and an Azure Bastion host named bastion1. Several NSGs contain rules that allow direct RDP access to the virtual machines by bypassing bastion1. You need to ensure that the virtual machines can be accessed only by using bastion1. The solution must prevent the use of NSG rules to bypass bastion1. What should you include in the solution?

  1. Azure Virtual Network Manager security admin rules Correct Answer
  2. Azure Virtual Network Manager connectivity configurations
  3. Azure Firewall application rules
  4. Azure Firewall network rules
virtual network manager security admin rules nsg precedence bastion rdp force bastion only access

Community Votes

A
83%
C
17%

83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Security admin rules in VNet Manager override NSG rules, so they can centrally block direct RDP irrespective of per-NSG allow rules; Azure Firewall rules do not override NSGs the same way.

To ensure VMs are reachable only through Azure Bastion and block direct RDP that bypasses it, use Azure Virtual Network Manager security admin rules, which take precedence over NSGs and centrally deny direct RDP.

Choosing Azure Firewall rules (C/D) — they filter traffic but do not take precedence over NSGs, so direct-RDP NSG allows could still bypass Bastion.

Community Discussion (3 comments)

Er_01 👍 3 Selected: A
Security admin rules take precedence over NSGs.
676ae1a 👍 1 Selected: C
Las reglas de aplicación de Azure Firewall te permiten definir y controlar de manera granular el tráfico de red basado en aplicaciones específicas. Puedes configurar las reglas de aplicación para bloquear cualquier intento de acceso RDP directo a las máquinas virtuales que no pase por bastion1. Utilizando Azure Firewall, puedes centralizar la gestión de seguridad y asegurarte de que todas las políticas se apliquen de manera coherente.
tuyi2 👍 2 Selected: A
https://learn.microsoft.com/en-us/azure/virtual-network-manager/overview

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Azure Virtual Network Manager security admin rules are evaluated above (have precedence over) network security groups, so they can centrally block direct RDP to the VMs regardless of any permissive NSG rules, forcing all RDP access through Azure Bastion.

Why the Other Options Are Wrong

Azure Firewall application (C) and network (D) rules filter traffic but do not override NSG rules, so a direct-RDP allow rule in an NSG could still bypass Bastion. Connectivity configurations (B) design connectivity, not security enforcement.

Community Comment Notes

The community favored A (83 votes). Comments note that security admin rules take precedence over NSGs, which is exactly what is needed to prevent NSG-based bypass of Bastion; a minority (C, 17 votes) suggested Azure Firewall.

Official Reference

https://learn.microsoft.com/en-us/azure/virtual-network-manager/overview

Related Analysis

Your on-premises network contains an Active Directory Domain

A-Grade

You have a Microsoft 365 tenant named contoso.com. You need

A-Grade

You have a Microsoft 365 tenant that uses Microsoft SharePoi

A-Grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide