SSH and RDP access in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when you try to SSH into an Azure VM without opening port 22?

You have deployed a Linux VM in Azure. You try to connect using SSH but the connection times out. What is the most likely reason?

A The VM's public IP address is not assigned.

B The Network Security Group (NSG) does not allow inbound traffic on port 22.

C Azure blocks all SSH traffic by default for security reasons.

D The VM's operating system does not support SSH connections by default.

💡 Hint

Check the firewall rules controlling network traffic to the VM.

Azure VMs require that the Network Security Group allows inbound traffic on port 22 for SSH. Without this, the connection will time out.

❓ Configuration

intermediate

Which Azure CLI command opens RDP access on port 3389 for a Windows VM?

You want to allow RDP access to your Windows VM by opening port 3389 in the NSG. Which command correctly adds this rule?

A az vm open-port --name MyVM --resource-group MyGroup --port 22

B az network nsg rule create --nsg-name MyNSG --resource-group MyGroup --name AllowSSH --protocol Tcp --direction Inbound --priority 1000 --source-address-prefixes '*' --source-port-ranges '*' --destination-port-ranges 3389 --access Allow

C az network nsg rule create --nsg-name MyNSG --resource-group MyGroup --name AllowRDP --protocol Tcp --direction Inbound --priority 1000 --source-address-prefixes '*' --source-port-ranges '*' --destination-port-ranges 3389 --access Allow

D az vm open-port --name MyVM --resource-group MyGroup --port 80

💡 Hint

Look for the command that creates an NSG rule for port 3389 with the correct name and protocol.

Option C correctly creates an NSG rule named AllowRDP allowing inbound TCP traffic on port 3389, which is the default port for RDP.

❓ Architecture

advanced

Best practice for securing SSH access to Azure VMs

You want to secure SSH access to your Linux VMs in Azure. Which architecture approach is best to reduce exposure to the internet?

A Use a jump box VM with a public IP and allow SSH only from trusted IPs to the jump box, then SSH from jump box to other VMs on private network.

B Disable SSH and use only Azure portal serial console for access.

C Allow SSH from any IP address by opening port 22 in the NSG.

D Open port 22 to the internet but require complex passwords on the VM.

💡 Hint

Think about minimizing direct internet exposure of your VMs.

Using a jump box (bastion host) limits direct SSH exposure. Only the jump box has a public IP and strict access, improving security.

❓ security

advanced

What is the effect of enabling Azure Bastion for RDP and SSH access?

You enable Azure Bastion on your virtual network. What is the main effect on how you access your VMs?

A You must open port 3389 and 22 on NSGs to use Azure Bastion.

B Azure Bastion disables all RDP and SSH access to VMs.

C Azure Bastion requires installing additional software on your local machine.

D You can connect to VMs via RDP and SSH directly through the Azure portal without exposing public IPs or opening ports.

💡 Hint

Consider how Azure Bastion changes the connection method to VMs.

Azure Bastion provides secure RDP and SSH access via the Azure portal over SSL, without exposing public IPs or opening ports.

✅ Best Practice

expert

How to enforce multi-factor authentication (MFA) for SSH access to Azure Linux VMs?

You want to require MFA when users SSH into your Azure Linux VMs. Which approach achieves this?

A Configure Azure Active Directory (Azure AD) login for Linux VMs and enable Conditional Access policies requiring MFA.

B Open port 22 and require users to enter a second password during SSH login.

C Use SSH keys only and disable password authentication.

D Enable MFA on the VM's local user accounts.

💡 Hint

Think about integrating Azure identity services with VM login.

Azure AD login for Linux VMs allows using Azure identities and Conditional Access policies, including MFA, for SSH access.

Practice

1. Which port does SSH use to connect securely to a Linux virtual machine in Azure?

easy

A. Port 3389

B. Port 22

C. Port 80

D. Port 443

Solution

1. Step 1: Identify SSH default port

   SSH (Secure Shell) uses port 22 by default to connect securely to Linux machines.

2. Step 2: Compare with other ports

   Port 3389 is used by RDP, port 80 is for HTTP, and port 443 is for HTTPS, so they are incorrect for SSH.

3. Final Answer:

   Port 22 -> Option B

4. Quick Check:

   SSH = Port 22 [OK]

Hint: SSH always uses port 22 for Linux access [OK]

Common Mistakes:

• Confusing SSH port with RDP port
• Using HTTP or HTTPS ports for SSH
• Assuming SSH uses a random port

2. Which of the following is the correct syntax to open port 3389 for RDP access in an Azure Network Security Group (NSG)?

easy

A. Allow inbound TCP on port 3389

B. Allow inbound TCP on port 22

C. Allow outbound UDP on port 3389

D. Allow inbound UDP on port 22

Solution

1. Step 1: Identify RDP port and protocol

   RDP uses TCP protocol on port 3389 for Windows remote desktop connections.

2. Step 2: Match correct NSG rule syntax

   Allowing inbound TCP on port 3389 opens RDP access. Other options use wrong ports or protocols.

3. Final Answer:

   Allow inbound TCP on port 3389 -> Option A

4. Quick Check:

   RDP = TCP 3389 inbound [OK]

Hint: RDP always needs inbound TCP on port 3389 [OK]

Common Mistakes:

• Using UDP instead of TCP
• Opening wrong port 22 for RDP
• Setting outbound instead of inbound rules

3. Given this Azure CLI command to open SSH access, what will it do?

az network nsg rule create --resource-group MyResourceGroup --nsg-name MyNSG --name AllowSSH --protocol Tcp --direction Inbound --priority 1000 --source-address-prefixes '*' --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges 22 --access Allow

medium

A. Allows inbound TCP traffic on port 22 from any source

B. Blocks inbound TCP traffic on port 22 from any source

C. Allows outbound TCP traffic on port 22 to any destination

D. Allows inbound UDP traffic on port 22 from any source

Solution

1. Step 1: Analyze command parameters

   The command creates an NSG rule named AllowSSH allowing inbound TCP traffic on port 22 from any source to any destination.

2. Step 2: Confirm traffic direction and protocol

   Direction is inbound, protocol is TCP, port is 22, and access is Allow, so it opens SSH access.

3. Final Answer:

   Allows inbound TCP traffic on port 22 from any source -> Option A

4. Quick Check:

   Inbound TCP 22 allowed = SSH access [OK]

Hint: Inbound TCP 22 with Allow opens SSH [OK]

Common Mistakes:

• Confusing inbound with outbound
• Using UDP instead of TCP
• Misreading port number

4. You tried to connect to a Windows VM via RDP but the connection timed out. Which of these is the most likely cause based on NSG rules?

medium

A. NSG allows inbound TCP on port 3389

B. NSG allows inbound UDP on port 22

C. NSG blocks inbound TCP on port 3389

D. NSG allows outbound TCP on port 3389

Solution

1. Step 1: Understand RDP connection requirements

   RDP requires inbound TCP access on port 3389 to allow remote desktop connections.

2. Step 2: Identify blocking rule

   If NSG blocks inbound TCP on port 3389, the connection will time out because traffic is denied.

3. Final Answer:

   NSG blocks inbound TCP on port 3389 -> Option C

4. Quick Check:

   Blocked inbound TCP 3389 causes timeout [OK]

Hint: Blocked inbound TCP 3389 causes RDP timeout [OK]

Common Mistakes:

• Confusing inbound with outbound rules
• Using wrong port for RDP
• Assuming UDP is needed for RDP

5. You want to secure SSH access to your Linux VM in Azure so only your office IP (203.0.113.5) can connect. Which NSG rule configuration is best?

hard

A. Allow inbound TCP on port 22 from source 0.0.0.0/0

B. Allow inbound TCP on port 3389 from source 203.0.113.5/32

C. Allow inbound UDP on port 22 from source 203.0.113.5/32

D. Allow inbound TCP on port 22 from source 203.0.113.5/32

Solution

1. Step 1: Identify SSH port and protocol

   SSH uses TCP on port 22, so the rule must allow TCP on port 22.

2. Step 2: Restrict source IP to office IP

   To secure access, restrict source to the office IP with /32 mask for a single IP.

3. Step 3: Exclude incorrect options

   Allow inbound TCP on port 22 from source 0.0.0.0/0 allows all IPs (not secure), Allow inbound UDP on port 22 from source 203.0.113.5/32 uses UDP (wrong protocol), Allow inbound TCP on port 3389 from source 203.0.113.5/32 uses RDP port (wrong service).

4. Final Answer:

   Allow inbound TCP on port 22 from source 203.0.113.5/32 -> Option D

5. Quick Check:

   Restrict SSH TCP 22 to office IP [OK]

Hint: Restrict SSH port 22 TCP to your IP only [OK]

Common Mistakes:

• Allowing all IPs instead of specific IP
• Using UDP instead of TCP
• Opening wrong port for SSH