Which TCP Ports Does Azure Bastion NSG Require for RDP?
DRAG DROP
You have an Azure virtual network named VNet1 that contains an AzureBastionSubnet. VNet1 contains a subnet named Subnet1. Subnet1 contains multiple virtual machines.
You plan to deploy Azure Bastion to provide secure RDP access to the virtual machines on Subnet1. You associate a network security group (NSG) named NSG1 to AzureBastionSubnet.
You need to configure rules for NSG1. The solution must meet the following requirements:
Allow required inbound access to Azure Bastion from the internet.
Allow user access to the virtual machines by using Azure Bastion.
Which TCP ports should you allow for the NSG1 rules? To answer, drag the appropriate ports to the correct rules. Each port may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Community Insight
It tests whether you know Bastion's NSG traffic direction: inbound Internet traffic terminates on TCP 443, while outbound RDP to the target VMs uses TCP 3389; the trap is swapping those ports.
This SC-500 drag-drop item tests the NSG port rules required on AzureBastionSubnet for Azure Bastion RDP access. The page establishes that NSG1 must allow inbound TCP 443 from the Internet and outbound TCP 3389 to Subnet1.
A common mistake is reversing the ports — allowing 3389 inbound from the Internet and 443 outbound — which is exactly what the learner comment suggests but does not match how Bastion proxies RDP over HTTPS.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Azure Bastion is a managed jump host: users connect over HTTPS to the Bastion resource, so the NSG on AzureBastionSubnet must allow inbound TCP 443 from the Internet. Bastion then initiates the RDP session to the target VM from the Bastion subnet, which is outbound traffic from AzureBastionSubnet to Subnet1 on TCP 3389. That is why the two required ports in this scenario are 443 inbound and 3389 outbound, not the reverse. Microsoft's Bastion NSG guidance also lists other control-plane/service rules, but the question isolates the Internet-facing and VM-access TCP ports.Why Other Candidate Answers Are Wrong
Putting 3389 on the inbound Internet rule would expose RDP directly and is not how Bastion works; Bastion receives HTTPS, not RDP, from the user. Using 443 outbound to Subnet1 confuses the Bastion front-end listener with the back-end VM connection: the VM listens for RDP on 3389, not HTTPS. Port 22 would be the correct outbound choice only for SSH to Linux VMs, so it does not satisfy this RDP requirement. Similarly, omitting the outbound rule breaks the Bastion-to-VM leg even if inbound 443 is allowed.Community Comment Notes
kungfumaster's comment proposes the reverse mapping — "Inbound from the internet: 3389 Outbound to subnet1: 443" — but that contradicts the documented Bastion traffic flow. The comment is useful as a warning about the most common trap in this drag-drop item: memorizing "RDP 3389" and placing it on the Internet-facing rule. Treat learner votes and comments as hints only and verify against Microsoft's Bastion NSG guidance.Official Reference
Exam Strategy
In drag-drop NSG items, decide direction first: traffic from the Internet to Bastion is inbound HTTPS 443, and Bastion-to-VM traffic is outbound to the target subnet on the management port (3389 RDP, 22 SSH). Do not let the VM's RDP port tempt you into putting 3389 on the Internet-facing inbound rule.
Frequently Asked Questions
Why does Azure Bastion use inbound port 443 instead of 3389?
Bastion accepts HTTPS sessions from the Azure portal or Internet on 443 and proxies RDP; 3389 is used outbound from the Bastion subnet to the target VM, not inbound from the Internet.
Do I also need an outbound port 22 rule on the AzureBastionSubnet NSG?
Only if you need SSH access to Linux VMs; for RDP the outbound rule is TCP 3389. Microsoft's Bastion NSG guidance also includes other required rules such as Gateway Manager access.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →